Profile: read-only name for cn-named directory entries

slapd refuses to remove an RDN value, and every legacy account is
cn=<name>,ou=People, so a name edit there always failed. Those accounts
now see their name read-only (the view rejects the profile action and
update_profile refuses as a backstop); uid-named accounts from website
registration can still edit it. README documents the cn/mail self-write
ACL and mail uniqueness overlay now applied in production.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -394,7 +394,10 @@ Other directory attributes (photos, SSH keys, addresses, `displayName`, etc.)
 are neither shown nor modified, so existing values are left in place. If the
 connector's `nameAttr` is changed, change `profiles.TEXT_ATTRIBUTES` to match.
 Saving the name replaces every `cn` value with the single entered value; Dex
-already uses only the first. Account DNs must not use `cn` as their RDN.
+already uses only the first. slapd refuses to remove an RDN value, so accounts
+whose DN is named by `cn` (the legacy `cn=<name>,ou=People` entries) see their
+name read-only; renaming them would change DNs other services store. Accounts
+created by website registration are `uid`-named and can edit their name.
 
 **Directory prerequisites:**
 
@@ -404,6 +407,9 @@ already uses only the first. Account DNs must not use `cn` as their RDN.
 	Accounts are pinned to immutable UUIDs; missing/deleted entries do not fall
 	back to a reused username. LDAP unavailability disables editing rather than
 	presenting an empty form that could erase values.
+- Example ACL (insert before the catch-all rule), plus the `unique` overlay with
+	`olcUniqueURI: ldap:///dc=eom,dc=dev?mail?sub`:
+	`to attrs=cn,mail by self write by dn="cn=admin,dc=eom,dc=dev" write by dn="cn=readonly,dc=eom,dc=dev" read by * none`
 - Every write binds with the member's **current LDAP password** and checks that
 	entry's UUID again. Configure directory **self-write ACLs** only for `cn`,
 	`mail` and self Password Modify; do not grant writes to `uid`,