Surface redacted directory bind failures before native onboarding

Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.

NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf

identity-provisioner/password_setup.py

@@ -4,15 +4,16 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 import hashlib
-import json
 import os
 import secrets
 import subprocess
 import threading
 import time
 from typing import Callable
-from urllib.request import Request, urlopen
 from urllib.parse import urlencode, urlsplit
+from urllib.request import urlopen
+
+from provisioner import directory_login
 
 
 @dataclass(frozen=True)
@@ -116,16 +117,12 @@ class LLDAPPasswordSetter:
         self.runner = runner
 
     def __call__(self, subject: str, password: str) -> None:
-        request = Request(
-            self.base_url + "/auth/simple/login",
-            data=json.dumps(
-                {"username": "admin", "password": self.admin_password}
-            ).encode(),
-            headers={"Content-Type": "application/json"},
-            method="POST",
+        token = directory_login(
+            base_url=self.base_url,
+            admin_password=self.admin_password,
+            opener=self.opener,
+            timeout=10,
         )
-        with self.opener(request, timeout=10) as response:
-            token = str(json.loads(response.read())["token"])
         env = dict(os.environ)
         env["LLDAP_USER_PASSWORD"] = password
         result = self.runner(