fix(secrets): honor env-supplied LDAP bind password in live LDAP integration suite; clarify pre-host migration

docs/GatewayTesting.md

@@ -236,10 +236,19 @@ LDAP groups resolve to the `Admin` role succeeds and emits the role claim;
 the password into `FailureMessage`; an unknown username fails authentication; and
 an unreachable LDAP server is absorbed into a failed result rather than throwing.
 
+`appsettings.json` now ships the LDAP bind password as the unexpanded
+`${secret:ldap/mxgateway/bind}` token (resolved at gateway startup by the
+pre-host secrets expander, which this suite's bare `ConfigurationBuilder`
+does not run). Before running the live LDAP suite, set
+`MxGateway__Ldap__ServiceAccountPassword` to the real GLAuth service-account
+password (dev value `serviceaccount123` for the shared GLAuth) so the suite
+binds with the real password instead of the literal token.
+
 Run the LDAP live tests explicitly:
 
 ```bash
 $env:MXGATEWAY_RUN_LIVE_LDAP_TESTS = "1"
+$env:MxGateway__Ldap__ServiceAccountPassword = "serviceaccount123"
 dotnet test src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj --filter FullyQualifiedName~DashboardLdapLiveTests
 ```