Profile: read-only name for cn-named directory entries

slapd refuses to remove an RDN value, and every legacy account is
cn=<name>,ou=People, so a name edit there always failed. Those accounts
now see their name read-only (the view rejects the profile action and
update_profile refuses as a backstop); uid-named accounts from website
registration can still edit it. README documents the cn/mail self-write
ACL and mail uniqueness overlay now applied in production.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

membership/templates/profile.html

@@ -45,6 +45,7 @@
     <nav class="profile-jump-links" aria-label="Profile sections">
         <a href="#identity">Name</a><a href="#email">Email</a>{% if newsletter_status %}<a href="#newsletter">Newsletter</a>{% endif %}<a href="#password">Password</a>
     </nav>
+    {% if name_editable %}
     <form id="identity" action="{% url 'members:profile' %}" method="post" class="member-panel profile-section profile-edit-form" aria-labelledby="identity-heading">
         {% csrf_token %}
         <input type="hidden" name="action" value="profile">
@@ -55,6 +56,13 @@
         {% include "profile_fields.html" with fields=form.authorization_fields only %}
         <button class="button button-primary" type="submit">Save name</button>
     </form>
+    {% else %}
+    <section id="identity" class="member-panel profile-section" aria-labelledby="identity-heading">
+        <h2 id="identity-heading">Name</h2>
+        <p class="profile-readonly-name"><strong>{{ name_values|first|default:account.uid }}</strong></p>
+        <p class="member-small">Your name is part of how your account is stored, so it can't be changed here. Contact eric@eom.dev if it needs updating.</p>
+    </section>
+    {% endif %}
     <section id="email" class="member-panel profile-section" aria-labelledby="email-heading">
         <h2 id="email-heading">Email address</h2>
         <p>Current email address:</p>