Discourse: sign in only through Dex, sign-up to /members

Drop discourse-ldap-auth (its authenticator ignores ldap_enabled) and
add an idempotent settings script, run after deploy, that disables
LDAP login and installs a theme component sending Sign Up to
www.eom.dev/members.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

files/discourse-sso.rb

@@ -0,0 +1,44 @@
+# Idempotent: sign-in goes only through Dex (discourse-openid-connect),
+# and the Sign Up button goes to the eom.dev membership site.
+# Run with: RAILS_ENV=production bundle exec rails runner <this file>
+
+SIGNUP_URL = "https://www.eom.dev/members"
+
+# OIDC is the only login method left, so with auth_immediately the
+# Log In button redirects straight to Dex. Accounts link by email.
+SiteSetting.ldap_enabled = false
+SiteSetting.enable_local_logins = false
+SiteSetting.auth_immediately = true
+# New members sign up at www.eom.dev; Discourse must still create their
+# account on first Dex login.
+SiteSetting.allow_new_registrations = true
+
+head_tag = <<~HTML
+  <script>
+  (function () {
+    var url = #{SIGNUP_URL.to_json};
+    if (location.pathname === "/signup") { location.replace(url); return; }
+    document.addEventListener("click", function (e) {
+      var b = e.target.closest(".sign-up-button, a[href='/signup']");
+      if (!b) return;
+      e.preventDefault();
+      e.stopImmediatePropagation();
+      location.href = url;
+    }, true);
+  })();
+  </script>
+HTML
+
+name = "eom.dev sign-up redirect"
+component = Theme.find_by(name: name) ||
+  Theme.create!(name: name, user_id: Discourse.system_user.id, component: true)
+component.set_field(target: :common, name: :head_tag, value: head_tag)
+component.save!
+
+Theme.where(component: false).find_each do |theme|
+  next if theme.child_themes.include?(component)
+  theme.add_relative_theme!(:child, component)
+end
+
+puts "ldap_enabled=#{SiteSetting.ldap_enabled} component=#{component.id} " \
+     "parents=#{component.parent_themes.pluck(:name).join(', ')}"