feat: add LDAP authentication settings and toggle

Add an admin-only LDAP configuration UI with an enable toggle and full
sign-in integration.

Backend:
- ldapSettings model + migration (single-row config)
- GET/PUT/test routes under /ldap (admin-gated; bind password masked)
- shared ldapClient with RFC 4515 filter escaping and empty-password guard
- signin tries local auth first, then LDAP when enabled (find-or-create
  local user) so the bootstrap admin is never locked out

Frontend:
- LDAP settings page (Switch + form + test connection) under /admin/ldap
- AdminNav tabs between user management and LDAP
- ldapControl util, types, and Ldap i18n namespace for all 6 locales

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/server.js

@@ -70,6 +70,14 @@ app.use('/users', usersUpdateRoleRoute(sequelize));
 app.use('/users', signUpRoute(sequelize));
 app.use('/users', signInRoute(sequelize));
 
+// "/ldap"
+import ldapIndexRoute from './routes/ldap/index.js';
+import ldapEditRoute from './routes/ldap/edit.js';
+import ldapTestRoute from './routes/ldap/test.js';
+app.use('/ldap', ldapIndexRoute(sequelize));
+app.use('/ldap', ldapEditRoute(sequelize));
+app.use('/ldap', ldapTestRoute(sequelize));
+
 // "/projects"
 import projectsIndexRoute from './routes/projects/index.js';
 import projectsShowRoute from './routes/projects/show.js';