Service sign-up buttons link to /members, which 404'd because only
/members/ is proxied. Use an absolute https target since TLS ends at
the ingress.
Add an opt-in task that creates any missing tier/service group from
the role's config (with the placeholder member) in the OpenLDAP pod,
leaving existing groups untouched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
