feat: add live-test container for the directory adapter

A test stage in the Dockerfile and an opt-in compose profile run the live
directory checks against the test OU inside the image, reading the LDAP_*
values from .env.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

compose.yaml

@@ -17,6 +17,27 @@ services:
       - no-new-privileges:true
     restart: unless-stopped
 
+  # Opt-in checks against the test OU. Reads the LDAP_* values from .env; the test user's
+  # current password comes from the shell:
+  #   LIVE_LDAP_TEST_PASSWORD=... docker compose --profile test run --rm live-test
+  live-test:
+    profiles: ["test"]
+    build:
+      context: .
+      target: test
+    environment:
+      PORTAL_LIVE_LDAP: "1"
+      LIVE_LDAP_SERVER: ${LDAP_SERVER:-}
+      LIVE_LDAP_USER_OU_DN: ${LDAP_USER_OU_DN:-}
+      LIVE_LDAP_BIND_DN: ${LDAP_BIND_DN:-}
+      LIVE_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-}
+      LIVE_LDAP_CA_FILE: /certs/ca.pem
+      LIVE_LDAP_PUBLISHER_GROUP_DN: ${LDAP_PUBLISHER_GROUP_DN:-}
+      LIVE_LDAP_ADMIN_GROUP_DN: ${LDAP_ADMIN_GROUP_DN:-}
+      LIVE_LDAP_TEST_PASSWORD:
+    volumes:
+      - ${CA_FILE_HOST:?set CA_FILE_HOST in .env}:/certs/ca.pem:ro
+
 volumes:
   data:
   backups: