www: redirect /members to /members/, ensure membership LDAP groups

Service sign-up buttons link to /members, which 404'd because only
/members/ is proxied. Use an absolute https target since TLS ends at
the ingress.

Add an opt-in task that creates any missing tier/service group from
the role's config (with the placeholder member) in the OpenLDAP pod,
leaving existing groups untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/membership.yml

@@ -207,3 +207,29 @@
       status: "True"
   loop: [membership, membership-worker]
   when: not ansible_check_mode
+
+- name: Find the OpenLDAP pod
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: "{{ www_membership_ldap_namespace }}"
+    label_selectors: ["{{ www_membership_ldap_pod_selector }}"]
+    field_selectors: [status.phase=Running]
+  register: www_ldap_pods
+  when: www_membership_ldap_ensure_groups | bool
+
+- name: Ensure membership tier and service groups exist in LDAP
+  kubernetes.core.k8s_exec:
+    namespace: "{{ www_membership_ldap_namespace }}"
+    pod: "{{ www_ldap_pods.resources[0].metadata.name }}"
+    command: >-
+      sh -c 'printf "%s\n" "dn: {{ item }}" "objectClass: groupOfUniqueNames"
+      "cn: {{ (item | split(","))[0] | regex_replace("^cn=", "") }}"
+      "uniqueMember: {{ (www_membership_environment | combine(www_membership_environment_overrides)).LDAP_GROUP_PLACEHOLDER_DN }}"
+      | ldapadd -x -H ldap://localhost -D "cn=admin,dc=eom,dc=dev" -w "$LDAP_ADMIN_PASSWORD"; rc=$?;
+      if [ $rc -eq 0 ]; then echo GROUP_CREATED; elif [ $rc -ne 68 ]; then exit $rc; fi'
+  loop: >-
+    {{ ((www_membership_tiers.values() | map(attribute='group_dn') | list)
+        + (www_membership_service_groups.values() | flatten)) | unique }}
+  register: www_ldap_groups
+  changed_when: "'GROUP_CREATED' in (www_ldap_groups.stdout | default(''))"
+  when: www_membership_ldap_ensure_groups | bool