docs: fix quickstart drift, add LICENSE, document admin bypass and LDAPS cert mount for public release (#17)

Cleanup pass ahead of the public release announcement:

- docs/index.md: fix the Quick Start block, which described a stale
  "edit config then re-run setup.sh a second time" flow. setup.sh now
  requires setup.env (with CFG_BASE_DN) before it will do anything, and
  builds + bootstraps + starts in a single run. Updated to match
  README.md's correct 4-line sequence.
- Add a standard MIT LICENSE at the repo root (theta42, 2026) so
  docs/index.md's "MIT License — see the repository for details" claim
  is actually true.
- docs/standalone.md: document the hardcoded auth.adminUsers:
  ['proxyadmin2'] local anti-lockout admin bypass written into every
  generated proxy-secrets.js — what it's for, that it requires a
  matching SSO user to actually use, and how to rename/extend/disable
  it.
- README.md + docker-compose.yml: fix the LDAPS strict-trust security
  note, which implied mounting the SSO's cert into the proxy was a
  config-only change. It also requires a docker-compose.yml edit
  (ldap-certs isn't mounted into the proxy service); added commented-out
  boilerplate for that mount and clarified the doc text.
- Also includes the pre-existing "Why use this instead of running the
  two separately?" README paragraph that was already staged as
  in-progress work.
- Verified: no Vagrant references, no emoji, and no hardcoded
  custom-domain URLs anywhere in this repo outside the proxy/ and
  sso-manager-node/ submodules; no docs/CNAME (github.io URL scheme
  confirmed).
- Added --- section dividers to docs/*.md to match README.md's
  formatting convention.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

docs/index.md

@@ -14,13 +14,15 @@ It exists for people whose needs are met by these two projects and who want to
 run them "very simply." Each project still works **standalone**; this repo just
 wires them together and automates the first-run glue.
 
+---
+
 ## Quick start
 
 ```bash
 git clone --recursive https://github.com/theta42/theta-env.git
 cd theta-env
-./setup.sh        # generates ./config/ the first time — edit it, then re-run
-./setup.sh        # builds + bootstraps + starts the stack
+cp setup.env.example setup.env     # then edit setup.env: set CFG_BASE_DN to your domain
+./setup.sh            # first run: generates ./config/ from setup.env, builds + bootstraps + starts
 ```
 
 You need **Docker** + **Docker Compose**. `./setup.sh` is idempotent — re-run any
@@ -30,6 +32,8 @@ See the [Quickstart Guide](quickstart.html) for a walkthrough of `./config/` and
 what `setup.sh` does, [Architecture](architecture.html) for how the pieces fit
 together, and [Standalone](standalone.html) for running each project on its own.
 
+---
+
 ## What you get
 
 - **SSO Manager** at `https://<SSO_HOST>` — log in as your first admin to manage
@@ -44,6 +48,8 @@ together, and [Standalone](standalone.html) for running each project on its own.
   creator (carrying their permissions); mint/rotate/revoke under **API Tokens**
   in each UI. See each submodule's DEPLOYMENT for the details.
 
+---
+
 ## The `./config/` values you must set
 
 All config and secrets live in `./config/sso-secrets.js` +
@@ -62,6 +68,8 @@ There is **no `.env`**. Set at least these in `./config/sso-secrets.js`:
 See `config.example/` for the full annotated shape (SMTP, LDAP cert CN, proxy
 OIDC/LDAP/auth, …).
 
+---
+
 ## Architecture
 
 ```
@@ -88,6 +96,8 @@ The proxy is **both** an OIDC client of the SSO (for login) **and** a direct LDA
 client (for user lookups). See [Architecture](architecture.html) for the full
 diagram + the first-run bootstrap flow.
 
+---
+
 ## Documentation
 
 - [Quickstart Guide](quickstart.html) — full walkthrough of `./config/` + `setup.sh`.
@@ -95,11 +105,15 @@ diagram + the first-run bootstrap flow.
   design, and how the bootstrap wires the proxy into a fresh SSO.
 - [Standalone](standalone.html) — running SSO Manager or the proxy on its own.
 
+---
+
 ## Community
 
 - [GitHub Repository](https://github.com/theta42/theta-env)
 - [Issue Tracker](https://github.com/theta42/theta-env/issues)
 
+---
+
 ## License
 
 MIT License — see the repository for details.