Clarify the openldap-tls SecretClass uses autoTls vs k8sSearch for real servers

The tutorial-openldap stack creates openldap-tls as an autoTls/autoGenerate
SecretClass: the Secret Operator owns the CA and uses it both to issue
OpenLDAP's server cert and to verify it. Contrast this with a real LDAP
server, where you only have the server's CA cert and use the k8sSearch
backend instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: lfrancke

modules/tutorials/pages/authentication_with_openldap.adoc

@@ -126,9 +126,12 @@ include::example$ldap-auth/ldap-authenticationclass.yaml[]
 // include::example$ldap-auth/30-install-openldap.sh[tag=apply-ldap-authenticationclass]
 
 The AuthenticationClass connects to LDAP over TLS (port `1636`) and verifies the server's certificate against the CA provided by the `openldap-tls` SecretClass.
-You did not have to create that SecretClass: the `tutorial-openldap` stack installed it for you, together with the CA certificate that OpenLDAP's TLS certificate was signed with.
+You did not have to create that SecretClass: the `tutorial-openldap` stack created it for you.
+It uses the `autoTls` backend with `autoGenerate: true`, so the Secret Operator generates its own certificate authority and uses it both to issue OpenLDAP's server certificate and to let the products verify that certificate.
+This works because the Secret Operator owns the CA, including its private key, from end to end.
 
-When you connect to a *real* LDAP server, this SecretClass does not exist yet and you have to create it yourself from your LDAP server's CA certificate.
+Connecting to a *real* LDAP server is different: you do not control the server's certificate and usually only have its CA certificate, not the CA's private key.
+In that case you create the SecretClass yourself using the `k8sSearch` backend, which simply makes the existing CA certificate available to the products.
 A SecretClass used only for server verification needs nothing but the CA certificate; it does not need a key.
 See xref:concepts:tls-server-verification.adoc[] for a complete, copy-pasteable example.