Fix SSO section: correct README/doc split, remove unverified LDAP claim

README is short/sharp facts, docs/*.md is full depth/process/reasoning
- that split had collapsed into either near-duplicate text in both
files or the fact missing from the README entirely. README now states
the OIDC zone-crossing fact in one crisp sentence; the full doc has
the complete step-by-step breakdown. The LDAP superuser workaround
claim is removed from both - the source material frames it as
contingency guidance for a scenario that may never have come up, not
documented deployed behavior, so it doesn't belong in either file.

README.md

@@ -99,7 +99,7 @@ A certificate expiring is a slow problem measured in days. A missing application
 → [docs/secret-distribution.md](docs/secret-distribution.md)
 
 ### 🪪 SSO & Identity
-Authentik, self-hosted, fronts single sign-on for every app in the fleet that supports it — a dozen-plus apps on native OIDC where the upstream software allows it, everything else behind proxy-based forward-auth so apps that were never built with SSO in mind still get it. Every app registers twice, once per reverse-proxy zone, because authentication always happens on the internal zone even when the app itself lives on the browser-facing one. Git automation follows the same least-privilege instinct: a scoped bot account with write access replaces routing CI through an admin identity, so a leaked automation credential is never an admin credential.
+Authentik fronts SSO fleet-wide, registered per app per zone actually needed. Every OIDC login crosses zones mid-handshake — the app lives on one zone, the real auth exchange happens on the other. Git automation follows the same least-privilege rule: a scoped bot account, never the admin identity.
 → [docs/sso-and-identity.md](docs/sso-and-identity.md)
 
 ### 🧱 Firewall & Network Segmentation