docs: fix test-environment scripts after first live run

Declare the service account DN before the OU loop and print the LDAP result
code and server message when the password-change check fails.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

docs/test-environment/Test-PortalLdaps.ps1

@@ -134,7 +134,13 @@ if ($TestPasswordChange) {
     $add.Name = 'unicodePwd'; $add.Operation = 'Add'; [void]$add.Add($enc.GetBytes('"' + $newPw + '"'))
     $ok = $true; $detail = ''
     try { [void]$conn.SendRequest((New-Object System.DirectoryServices.Protocols.ModifyRequest($userDn, @($del, $add)))) }
-    catch { $ok = $false; $detail = $_.Exception.Message }
+    catch {
+        $ok = $false; $detail = $_.Exception.Message
+        $inner = $_.Exception.InnerException
+        if ($inner -is [System.DirectoryServices.Protocols.DirectoryOperationException]) {
+            $detail += " [LDAP result: $($inner.Response.ResultCode); server: $($inner.Response.ErrorMessage)]"
+        }
+    }
     Report 'change a password with the Change Password right' $ok $detail
 }
 else { Write-Host 'SKIP  password change (use -TestPasswordChange; it changes the test user password)' -ForegroundColor Yellow }