Thanks for the offer to help! Actually, the update that triggered the scare was buried a few layers further - it seems it hadn't been updated since installation (or near after) - with the version I was running released late 2024, and the system installed October '24. When I first hit the "update" button, it took me a Nextcloud version newer, then once again, then after those two upgrades (to .5, I think), I was offered the LDAP change - but it seemed totally normal.
I definitely can't say the system did much to notify me of the updates or the change (I don't really hear much from Cloudron itself, but the Nextcloud app pings me about "app updates" available). When clicking through it, it presented the usual changelog, which I read - and the bit about the auth change sounded like a "that should be fine?" by the way it was presented.
Unfortunately I can't recall for sure what settings I chose at the time of install. Is there any way to determine that after-the-fact?
As far as diagnosis, I did download the logs at the time (during my repair attempts). 15 MB of logs, spanning back with lots of personal activity and filenames, etc... maybe I can try and sanitize that (e.g. trim to just the upgrade points) and send it along?
As for restoring from a backup, is it okay to just restore the app volume's structure (containing "apps", "config", "data", etc) but omit the file tree (/data/myname/*)? That is, is there additional metadata about the app that might get corrupted by doing so? If I were able to do that, I believe it contains the database and everything should just snap into place if I "stop" the app, restore everything, then "start" it, I'd imagine...
(that is, if a future situation puts me in a situation where I need to restore such a backup... I'm good at the moment; it seems everything is working!)
Let me know about that log, and maybe how to determine its user config, and I'll give you what I can 
edit to add: my Cloudron username is, indeed, the same as my Nextcloud username.
If it were, a btrfs snapshot (with "btrfs send | btrfs receive" cloning and management to the external backup drive) would just Thanos-snap it into persistent security... (btrfs is pretty freaking awesome, imo... 10/10 would store life on it)