authentik: add LDAP outpost service for Jellyfin LDAP-Auth

- New authentik-outpost-ldap quadlet: ghcr.io/goauthentik/ldap:2026.8.0,
  publishes host 389/636 -> container 3389/6636 for cross-host binds from
  dankserver's Jellyfin LDAP-Auth plugin; outpost token in host .env.
- deploy-plan.py: register authentik-outpost-ldap in SERVICE_ORDER and
  DANKCLAW_SERVICES; map dankclaw/authentik/quadlet/ unit path.
- deploy-remote.sh: deploy_authentik_outpost_ldap handler + dispatch case.
- deploy.sh: valid-service entry.

dankclaw/authentik/quadlet/authentik-outpost-ldap.container

@@ -0,0 +1,38 @@
+# Quadlet unit: Authentik LDAP outpost (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/authentik-outpost-ldap.container
+# Unit name: authentik-outpost-ldap.service (podman 5.x drops the container- prefix)
+#
+# Serves the authentik LDAP provider ("Jellyfin LDAP", Base DN
+# dc=franksdank,dc=cloud) so dankserver's Jellyfin can authenticate its users
+# via the LDAP-Auth plugin. The type-specific ghcr.io/goauthentik/ldap image
+# listens on 3389 (ldap) / 6636 (ldaps) inside the container; published to
+# host 389/636 for cross-host binds from dankserver. The outpost token lives
+# in the host .env (AUTHENTIK_LDAP_OUTPOST_TOKEN), never in this repo. The
+# outpost dials core over websocket at AUTHENTIK_HOST; auth. is guard-chain
+# exempt (IdP).
+
+[Unit]
+Description=Authentik LDAP outpost container
+After=network.target authentik-server.service
+Wants=authentik-server.service
+
+[Container]
+ContainerName=authentik-outpost-ldap
+Image=ghcr.io/goauthentik/ldap:2026.8.0
+Network=dankclaw_default
+EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
+Environment=AUTHENTIK_HOST=https://auth.franksdank.cloud
+Environment=AUTHENTIK_INSECURE=false
+Environment=AUTHENTIK_TOKEN=${AUTHENTIK_LDAP_OUTPOST_TOKEN}
+PublishPort=389:3389
+PublishPort=636:6636
+User=0:0
+
+[Service]
+EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target