THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET.

The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e`
(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally
NOT committed here because:
  * the real host age recipients are not available to the author of this change
    (they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and
  * fabricating an encrypted blob or fake host keys would be misleading.

Committing this file as `ldap-bind.age` would let modules/sssd.nix reference
`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at
runtime. Do ONE of the following before deploying:

  1. Preferred: generate the real secret (secrets/README.md), commit it as
     secrets/ldap-bind.age, and delete this .PLACEHOLDER file.

The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare
password):

    [domain/default]
    ldap_default_authtok = <the sssd-bind service-account password>