podman 5.7.0 refuses ghcr.io/goauthentik/ldap:2026.8.0's nested manifest list ('Unexpectedly received a manifest list instead of a manifest for a single image'); pin the linux/amd64 single-platform digest instead.
- New authentik-outpost-ldap quadlet: ghcr.io/goauthentik/ldap:2026.8.0, publishes host 389/636 -> container 3389/6636 for cross-host binds from dankserver's Jellyfin LDAP-Auth plugin; outpost token in host .env. - deploy-plan.py: register authentik-outpost-ldap in SERVICE_ORDER and DANKCLAW_SERVICES; map dankclaw/authentik/quadlet/ unit path. - deploy-remote.sh: deploy_authentik_outpost_ldap handler + dispatch case. - deploy.sh: valid-service entry.