authentik: add LDAP outpost service for Jellyfin LDAP-Auth

- New authentik-outpost-ldap quadlet: ghcr.io/goauthentik/ldap:2026.8.0,
  publishes host 389/636 -> container 3389/6636 for cross-host binds from
  dankserver's Jellyfin LDAP-Auth plugin; outpost token in host .env.
- deploy-plan.py: register authentik-outpost-ldap in SERVICE_ORDER and
  DANKCLAW_SERVICES; map dankclaw/authentik/quadlet/ unit path.
- deploy-remote.sh: deploy_authentik_outpost_ldap handler + dispatch case.
- deploy.sh: valid-service entry.

scripts/deploy-remote.sh

@@ -706,6 +706,20 @@ deploy_authentik_outpost() {
         echo "WARN: authentik-outpost did not come up active" >&2
 }
 
+deploy_authentik_outpost_ldap() {
+    # Dedicated LDAP outpost for Jellyfin's LDAP-Auth plugin. The type-specific
+    # ghcr.io/goauthentik/ldap image serves 3389/6636 container-side, published
+    # as host 389/636 for cross-host binds from dankserver. The outpost token
+    # lives in the host .env, never in this repo. Restarting only this unit
+    # cycles LDAP auth for a few seconds; the rest of the stack is untouched.
+    cp dankclaw/authentik/quadlet/authentik-outpost-ldap.container "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    systemctl --user restart authentik-outpost-ldap.service
+    sleep 5
+    systemctl --user is-active --quiet authentik-outpost-ldap.service || \
+        echo "WARN: authentik-outpost-ldap did not come up active" >&2
+}
+
 deploy_hermes() {
     # The hermes trio (gateway, dashboard, webui) shares one image and the
     # /data volume and deploys as one unit: install the units, retire the
@@ -981,6 +995,9 @@ deploy_service() {
         authentik-outpost)
             deploy_authentik_outpost
             ;;
+        authentik-outpost-ldap)
+            deploy_authentik_outpost_ldap
+            ;;
         anubis) deploy_anubis ;;
         seerr) deploy_seerr ;;
         frank-default-large) deploy_llm_large ;;