Switch LDAP avatar lookups to LDAPS (#95)

api/user_avatar.php connected via ldap://$ldapHost:$ldapPort — never
ldaps://, and there was no ldap_start_tls() call anywhere in the
codebase. LDAP_BIND_PW was sent over the wire unencrypted on every
avatar fetch.

Switched to ldaps://, and changed LDAP_HOST/LDAP_PORT's defaults to
ldap.lotusguild.org:6360 (lldap's LDAPS listener) instead of the bare
IP on port 3890 (plaintext). PHP's ldap extension verifies the server
cert's hostname by default, so a bare IP won't validate against the
LDAPS cert (issued for *.lotusguild.org) — LDAP_HOST has to be a
hostname the cert covers. This is deliberately not configurable back to
plaintext ldap://.

Infra change (pve-infra, separate repo/commit): added a Pi-hole
split-horizon override so ldap.lotusguild.org resolves internally to
the real LDAP server's LAN IP — its existing public DNS record points
elsewhere (an unrelated host), and there was no internal-only DNS entry
for it before this.

Verified against the real lldap server (pct 147, LDAPS on 6360, a live
Let's Encrypt *.lotusguild.org cert): confirmed the Pi-hole override
resolves correctly from hosts using it as their resolver, then ran the
exact ldap_connect/ldap_bind sequence via `php -r` directly on the
production tinker_tickets host (10.10.10.45) with a deliberately wrong
bind password — got "Invalid credentials" (a real LDAP protocol
response), not a transport/TLS error, proving the full connect + TLS
handshake + hostname verification + bind path works end-to-end in the
actual deployment environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117oBw2jN4kALYeS8HPq4zV

.env.example

@@ -74,10 +74,14 @@ TRUSTED_PROXIES=
 ; Timezone (default: America/New_York)
 TIMEZONE=America/New_York
 
-; LDAP / lldap (for user avatar lookups)
+; LDAP / lldap (for user avatar lookups). Connects over LDAPS — 6360 is
+; lldap's default LDAPS port, NOT its plaintext port (3890), since
+; LDAP_BIND_PW below would otherwise go over the wire unencrypted.
+; LDAP_HOST must be a hostname matching the LDAPS cert (TLS hostname
+; verification is not skipped), not a bare IP.
 LDAP_ENABLED=true
-LDAP_HOST=10.10.10.39
-LDAP_PORT=3890
+LDAP_HOST=ldap.lotusguild.org
+LDAP_PORT=6360
 LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
 LDAP_BIND_PW=
 LDAP_BASE_DN="dc=example,dc=com"