authentik: add LDAP outpost service for Jellyfin LDAP-Auth

- New authentik-outpost-ldap quadlet: ghcr.io/goauthentik/ldap:2026.8.0,
  publishes host 389/636 -> container 3389/6636 for cross-host binds from
  dankserver's Jellyfin LDAP-Auth plugin; outpost token in host .env.
- deploy-plan.py: register authentik-outpost-ldap in SERVICE_ORDER and
  DANKCLAW_SERVICES; map dankclaw/authentik/quadlet/ unit path.
- deploy-remote.sh: deploy_authentik_outpost_ldap handler + dispatch case.
- deploy.sh: valid-service entry.

scripts/deploy-plan.py

@@ -41,6 +41,7 @@ SERVICE_ORDER = (
     "authentik-server",
     "authentik-worker",
     "authentik-outpost",
+    "authentik-outpost-ldap",
     "caddy",
     "homepage",
     "romm-mariadb",
@@ -83,6 +84,7 @@ DANKCLAW_SERVICES = {
     "authentik-server",
     "authentik-worker",
     "authentik-outpost",
+    "authentik-outpost-ldap",
     "caddy",
     "homepage",
     "frank-default-large",
@@ -276,7 +278,7 @@ def services_for_path(path: str, target: str) -> set[str]:
             return services
         if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":
             name = parts[3].removesuffix(".container")
-            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost"}:
+            if name in {"authentik-postgres", "authentik-server", "authentik-worker", "authentik-outpost", "authentik-outpost-ldap"}:
                 _add(services, name)
             return services
         if len(parts) >= 2 and parts[1] == "searxng":