Advertise UserName token policy on any non-None security profile when Ldap.Enabled; emit a startup LogWarning when Ldap.Enabled=true but SecurityProfile=None so the misconfiguration is surfaced before clients connect rather than silently producing no credential path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>