www: redirect /members to /members/, ensure membership LDAP groups

Service sign-up buttons link to /members, which 404'd because only
/members/ is proxied. Use an absolute https target since TLS ends at
the ingress.

Add an opt-in task that creates any missing tier/service group from
the role's config (with the placeholder member) in the OpenLDAP pod,
leaving existing groups untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -204,3 +204,9 @@ www_membership_tiers:
       - Exclusive polls on the direction of the platform
       - Optional Diamond credit on the supporters page
       - Your biggest boost for independent public projects
+
+# Create any missing tier/service groups (with the placeholder member) in the
+# OpenLDAP pod. Existing groups and their members are left untouched.
+www_membership_ldap_ensure_groups: false
+www_membership_ldap_namespace: openldap
+www_membership_ldap_pod_selector: app=openldap