Fix ldap-init race on first-run setup

The 389ds image healthcheck (dscontainer -H) only validates the LDAPI
socket. On an empty volume, instance setup runs a temporary slapd that
exposes LDAPI but not TCP 3389, so Docker marked the ldap service
healthy too early. That let ldap-init start before the real slapd was
listening, failing with "Can't contact LDAP server - 107 - Socket not
connected".

Override the healthcheck to probe the real TCP listener and bind as
cn=Directory Manager with the configured password, and add a bounded
wait loop to ldap-init so it retries until the server is reachable.

docker-compose.yml

@@ -12,6 +12,12 @@ services:
     environment:
       DS_DM_PASSWORD: passthebutter
       SUFFIX_NAME: "dc=kosmos,dc=org"
+    healthcheck:
+      test: ["CMD-SHELL", "ldapsearch -x -H ldap://localhost:3389 -D 'cn=Directory Manager' -w \"$$DS_DM_PASSWORD\" -b '' -s base '(objectclass=*)' >/dev/null 2>&1"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
 
   ldap-init:
     image: 4teamwork/389ds:latest

docker/ldap-init.sh

@@ -4,6 +4,18 @@ set -e
 SUFFIX="${LDAP_SUFFIX:-dc=kosmos,dc=org}"
 URI="ldap://ldap:3389"
 
+attempt=1
+until dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
+        backend suffix list --suffix >/dev/null 2>&1; do
+  if [ "$attempt" -ge 60 ]; then
+    echo "Timed out waiting for LDAP server at $URI" >&2
+    exit 1
+  fi
+  echo "Waiting for LDAP server at $URI (attempt $attempt)..."
+  attempt=$((attempt + 1))
+  sleep 2
+done
+
 if dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
      backend suffix list --suffix 2>/dev/null | grep -Fqx "$SUFFIX"; then
   echo "LDAP backend for $SUFFIX already exists, skipping."