docs(docker)+docs(docker-env2)+infra: close P8-7 + P8-10 — LDAP doc drift + env2 gRPC port/teardown parity

P8-7: docker/README.md and docker-env2/README.md still listed the retired
scadabridge-ldap container. Verified against the running config
(central-node-*/appsettings.Central.json): both rigs actually bind to the
local redundant GLAuth pair (zb-ldap-primary :3893 + zb-ldap-backup :3894 on
host.docker.internal, source of truth scadaproj/infra/glauth-redundant), not
the shared 10.100.0.35 GLAuth the infra/docker-compose.yml retirement comment
claimed — that binding is itself stale, its serviceaccount password having
been rotated away by SEC-36. Corrected all three docs to name the actual
config each rig uses.

P8-10: docker-env2 mapped no host port for the central gRPC control plane
(docker/ maps 9013/9014->8083); added 9113/9114->8083 on both env2 centrals,
matching the free 91XX slots, plus the README port table. teardown.sh's
"preserved in node directories" data note predates the named-volume
migration; rewrote it honestly and added an explicit `docker volume rm`
recipe scoped to the env2 volume prefix, clearly labeled destructive,
mirroring docker/teardown.sh's existing pattern.

Gate: bash docker-env2/deploy.sh from this worktree — both centrals + both
site-x nodes recreated and came up with the new 9113/9114 ports open. The
simultaneous force-recreate split both pairs into independent 1-node
clusters (expected: BootstrapGuard is default-OFF on docker-env2, per
CLAUDE.md); a single restart of the b-side of each pair joined it to its
already-formed peer and both pairs converged (central: memberCount=2,
leader=central-a; site-x: node-b Welcome + singleton Younger). docker/ (the
primary rig) was not touched.

infra/docker-compose.yml

@@ -41,11 +41,16 @@ services:
       - scadabridge-net
     restart: unless-stopped
 
-  # RETIRED 2026-06-04: superseded by the shared dev GLAuth on 10.100.0.35:3893
-  # (scadaproj/infra/glauth/). The central nodes now bind there (see
-  # docker/ + docker-env2 central-node appsettings: Ldap:Server=10.100.0.35).
-  # Kept here, commented, for rollback — uncomment + `docker compose up -d ldap`
-  # and revert the central-node Server back to "scadabridge-ldap".
+  # RETIRED 2026-06-04: originally superseded by the shared dev GLAuth on
+  # 10.100.0.35:3893 (scadaproj/infra/glauth/). That binding is itself now stale —
+  # the shared GLAuth's serviceaccount password was rotated (SEC-36) and is no
+  # longer valid, so both docker/ and docker-env2 central nodes now bind to the
+  # local redundant GLAuth pair instead: zb-ldap-primary on
+  # host.docker.internal:3893 with zb-ldap-backup on host.docker.internal:3894 as
+  # FallbackServers (source of truth: scadaproj/infra/glauth-redundant; see each
+  # central node's appsettings.Central.json). Kept here, commented, for rollback —
+  # uncomment + `docker compose up -d ldap` and point the central-node Server back
+  # at "scadabridge-ldap".
   # ldap:
   #   image: glauth/glauth:latest
   #   container_name: scadabridge-ldap