Sign-in is set up from the console, and a directory tried before it is kept

People → Sign-in shows single sign-on, Active Directory and SCIM, and
the directory's last sync. E sets up Entra ID from the tenant and client
IDs; D sets up Active Directory, tried from the control plane first:
each server bound, people who may sign in, members of each mapped group.
The secrets go into the store as store:auth/..., sealed by the master
key, and the CA into the settings, so no control plane needs a file.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/reference.md

@@ -151,6 +151,7 @@ rather than repeated.
 | `urls` | `[]string` | [LDAP](#ldap) |
 | `start_tls` | `bool` | [LDAP](#ldap) |
 | `ca_file` | `string` | [LDAP](#ldap) |
+| `ca` | `string` | [LDAP](#ldap) |
 | `bind_dn` | `string` | [LDAP](#ldap) |
 | `bind_password_file` | `string` | [LDAP](#ldap) |
 | `base_dn` | `string` | [LDAP](#ldap) |
@@ -1475,6 +1476,14 @@ is refused.
 CAFile is the authority the servers' certificates are checked against,
 when it is not the system's: an AD Certificate Services root.
 
+### `ca`
+
+`string`
+
+CA is the same authority written out, PEM: kept in the cluster's
+settings, so no file has to be put on every control plane. Used in
+place of CAFile when both are set.
+
 ### `bind_dn`
 
 `string`