docs: fix test-environment scripts after first live run

Declare the service account DN before the OU loop and print the LDAP result
code and server message when the password-change check fails.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

docs/test-environment/New-PortalTestEnvironment.ps1

@@ -72,6 +72,7 @@ $domain = Get-ADDomain
 $netbios = $domain.NetBIOSName
 $testOuDn = "OU=$TestOuName,$ParentDn"
 $svcOuDn = "OU=$ServiceOuName,$ParentDn"
+$svcDn = "CN=$ServiceAccountName,$svcOuDn"
 $real = -not $WhatIfPreference
 $secrets = [ordered]@{}
 $groups = @{}
@@ -89,7 +90,6 @@ foreach ($ou in @(@($TestOuName, $testOuDn), @($ServiceOuName, $svcOuDn))) {
 }
 
 # --- service account (outside the test OU on purpose) ------------------------
-$svcDn = "CN=$ServiceAccountName,$svcOuDn"
 if (Test-Dn $svcDn) {
     Write-Host "Service account exists: $svcDn (password unchanged)"
 }