fix: setup.sh ldap.vars re-run abort + drop app_super_admin; roll up sso v1.26.1 (v1.36.1) (#162)

- setup.sh: ldap.vars generation read CFG_* first-run vars (unset on re-run);
  now reads real values from sso-secrets.js, so LDAP enrollment works on re-runs
- generated ldap_access_groups now references god_admin (app_super_admin gone)
- gitlink: sso-manager-node 8db00f0 (v1.26.1)

bootstrap/bootstrap.js

@@ -90,10 +90,11 @@ const CLIENT_NAME = 'theta-proxy';
 const ADMIN_DN  = `cn=${ADMIN_UID},ou=people,${BASE_DN}`;
 const SVC_DN    = `cn=ldapclient,ou=people,${BASE_DN}`;
 // god_admin is the global super group (docs/GROUPS.md §2); the bootstrapped
-// admin is its first member. app_sso_admin / app_sso_oauth_admin are the legacy
+// admin is its first member. app_sso_admin / app_sso_oauth_admin are the
 // per-console admin groups still used by the SSO UI. god_admin is nested into
-// app_super_admin by docker-entrypoint.sh, so LDAP-level consumers (SSSD, sudo)
-// resolve it transitively.
+// the app_sso_* groups (and every resource's _admin group) by
+// docker-entrypoint.sh + api_directory_admin, so LDAP-level consumers (SSSD,
+// sudo) resolve it transitively.
 const ADMIN_GROUPS = ['god_admin', 'app_sso_admin', 'app_sso_oauth_admin'];
 
 const log  = (...a) => process.stderr.write('[bootstrap] ' + a.join(' ') + '\n');