v1.1.15

Changed

• Rewrote install.sh as an idempotent git-clone installer, replacing the old flag-driven, copy-based one — wget -O - .../install.sh | sudo bash now works the same way it does for theta42/proxy. Installs to /opt/theta42/sso-manager (was /opt/sso-manager). First run only: bootstraps OpenLDAP with a generated admin password + JWT secret and seeds /etc/sso-manager/secrets.js (was /opt/sso-manager/conf/secrets.js, hand-filled from CLI flags); later runs never touch LDAP or the secrets file again. ops/systemd/sso-manager.service sets CONF_SECRETS=/etc/sso-manager/secrets.js to match.
• install.sh now prints the version it's updating from/to (or "Already up to date") on every run.

Fixed

• install.sh could hang indefinitely on a fresh host if a base package pulled in tzdata as a new dependency (no TTY for the interactive timezone prompt), or if the debconf slapd/domain value was malformed (a raw DN fragment instead of a dotted domain) — slapd's postinst hangs rather than failing cleanly on a bad domain. Both fixed.
• ops/ldap-setup.sh's ppolicy-overlay checks used an LDAP substring filter against an attribute that doesn't support substring matching, so they always reported the overlay as unconfigured even when it was correctly set up (stored as {0}ppolicy) — the final verification step always failed as a result. Fixed to filter on (objectClass=olcOverlayConfig) instead, matching every other check in that script.