feat: add LDAP authentication settings and toggle

Add an admin-only LDAP configuration UI with an enable toggle and full
sign-in integration.

Backend:
- ldapSettings model + migration (single-row config)
- GET/PUT/test routes under /ldap (admin-gated; bind password masked)
- shared ldapClient with RFC 4515 filter escaping and empty-password guard
- signin tries local auth first, then LDAP when enabled (find-or-create
  local user) so the bootstrap admin is never locked out

Frontend:
- LDAP settings page (Switch + form + test connection) under /admin/ldap
- AdminNav tabs between user management and LDAP
- ldapControl util, types, and Ldap i18n namespace for all 6 locales

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routes/users/signin.js

@@ -4,37 +4,65 @@ import { DataTypes } from 'sequelize';
 import bcrypt from 'bcrypt';
 import jwt from 'jsonwebtoken';
 import defineUser from '../../models/users.js';
-import { defaultDangerKey } from './authSettings.js';
+import defineLdapSetting from '../../models/ldapSettings.js';
+import { authenticateLdap, getLdapSettings } from '../ldap/ldapClient.js';
+import { roles, defaultDangerKey } from './authSettings.js';
 
 export default function (sequelize) {
   const User = defineUser(sequelize, DataTypes);
+  const LdapSetting = defineLdapSetting(sequelize, DataTypes);
   const secretKey = process.env.SECRET_KEY || defaultDangerKey;
 
+  function issueToken(res, user) {
+    const accessToken = jwt.sign({ userId: user.id }, secretKey, {
+      expiresIn: '24h',
+    });
+    const expiresAt = Date.now() + 3600 * 1000 * 24; // expire date(ms)
+    res.status(200).json({ access_token: accessToken, expires_at: expiresAt, user });
+  }
+
   router.post('/signin', async (req, res) => {
     try {
       const { email, password } = req.body;
-      const user = await User.findOne({
-        where: {
-          email: email,
-        },
-      });
-      if (!user) {
-        return res.status(401).json({ error: 'Authentication failed' });
+
+      // Local authentication first. This keeps existing accounts (including
+      // the bootstrap administrator) usable even when LDAP is enabled.
+      const user = await User.findOne({ where: { email } });
+      if (user) {
+        const passwordMatch = await bcrypt.compare(password, user.password);
+        if (passwordMatch) {
+          return issueToken(res, user);
+        }
       }
 
-      const passwordMatch = await bcrypt.compare(password, user.password);
-      if (!passwordMatch) {
-        return res.status(401).json({ error: 'Authentication failed' });
+      // Fall back to LDAP when enabled. The email field carries the LDAP login
+      // identifier (substituted into the configured search filter).
+      const ldapSettings = await getLdapSettings(LdapSetting);
+      if (ldapSettings.enabled) {
+        try {
+          const ldapUser = await authenticateLdap(ldapSettings, email, password);
+          // Find-or-create a local user keyed by the directory email.
+          let localUser = user || (await User.findOne({ where: { email: ldapUser.email } }));
+          if (!localUser) {
+            const userRoleIndex = roles.findIndex((entry) => entry.uid === 'user');
+            const randomPassword = await bcrypt.hash(jwt.sign({ t: Date.now() }, secretKey), 10);
+            localUser = await User.create({
+              email: ldapUser.email,
+              password: randomPassword,
+              username: ldapUser.username,
+              role: userRoleIndex,
+            });
+          }
+          return issueToken(res, localUser);
+        } catch (ldapError) {
+          console.error('LDAP authentication failed:', ldapError.message);
+        }
       }
-      const accessToken = jwt.sign({ userId: user.id }, secretKey, {
-        expiresIn: '24h',
-      });
-      const expiresAt = Date.now() + 3600 * 1000 * 24; // expire date(ms)
 
-      res.status(200).json({ access_token: accessToken, expires_at: expiresAt, user });
+      return res.status(401).json({ error: 'Authentication failed' });
     } catch (error) {
       console.error(error);
-      res.status(500).send('Sign up failed');
+      res.status(500).send('Sign in failed');
     }
   });