feat: add LDAP authentication settings and toggle

Add an admin-only LDAP configuration UI with an enable toggle and full
sign-in integration.

Backend:
- ldapSettings model + migration (single-row config)
- GET/PUT/test routes under /ldap (admin-gated; bind password masked)
- shared ldapClient with RFC 4515 filter escaping and empty-password guard
- signin tries local auth first, then LDAP when enabled (find-or-create
  local user) so the bootstrap admin is never locked out

Frontend:
- LDAP settings page (Switch + form + test connection) under /admin/ldap
- AdminNav tabs between user management and LDAP
- ldapControl util, types, and Ldap i18n namespace for all 6 locales

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/messages/de.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "Benutzerverwaltung",
+    "ldap": "LDAP",
     "avatar": "Avatar",
     "id": "ID",
     "email": "E-Mail",
@@ -434,5 +435,27 @@
     "tag_error_create": "Tag konnte nicht erstellt werden. Bitte versuche es erneut.",
     "tag_error_update": "Tag konnte nicht aktualisiert werden. Bitte versuche es erneut.",
     "tag_error_delete": "Tag konnte nicht gelöscht werden. Bitte versuche es erneut."
+  },
+  "Ldap": {
+    "ldap_settings": "LDAP-Einstellungen",
+    "ldap_description": "Benutzer über ein LDAP-Verzeichnis authentifizieren.",
+    "enable_ldap": "LDAP aktivieren",
+    "enable_ldap_desc": "Benutzern erlauben, sich mit ihren Verzeichnis-Anmeldedaten anzumelden.",
+    "server_url": "Server-URL",
+    "bind_dn": "Bind-DN",
+    "bind_credentials": "Bind-Passwort",
+    "bind_credentials_placeholder": "Leer lassen, um das aktuelle Passwort beizubehalten",
+    "search_base": "Suchbasis",
+    "search_filter": "Suchfilter",
+    "email_attribute": "E-Mail-Attribut",
+    "username_attribute": "Benutzername-Attribut",
+    "save": "Speichern",
+    "saved": "LDAP-Einstellungen gespeichert",
+    "save_error": "LDAP-Einstellungen konnten nicht gespeichert werden",
+    "test_connection": "Verbindung testen",
+    "test_username": "Test-Benutzername",
+    "test_password": "Test-Passwort",
+    "test_success": "Verbindung erfolgreich",
+    "test_failed": "Verbindung fehlgeschlagen"
   }
 }

frontend/messages/en.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "User Management",
+    "ldap": "LDAP",
     "avatar": "Avatar",
     "id": "ID",
     "email": "Email",
@@ -434,5 +435,27 @@
     "tag_error_create": "Failed to create tag. Please try again.",
     "tag_error_update": "Failed to update tag. Please try again.",
     "tag_error_delete": "Failed to delete tag. Please try again."
+  },
+  "Ldap": {
+    "ldap_settings": "LDAP Settings",
+    "ldap_description": "Authenticate users against an LDAP directory.",
+    "enable_ldap": "Enable LDAP",
+    "enable_ldap_desc": "Allow users to sign in with their directory credentials.",
+    "server_url": "Server URL",
+    "bind_dn": "Bind DN",
+    "bind_credentials": "Bind Password",
+    "bind_credentials_placeholder": "Leave blank to keep current password",
+    "search_base": "Search Base",
+    "search_filter": "Search Filter",
+    "email_attribute": "Email Attribute",
+    "username_attribute": "Username Attribute",
+    "save": "Save",
+    "saved": "LDAP settings saved",
+    "save_error": "Failed to save LDAP settings",
+    "test_connection": "Test Connection",
+    "test_username": "Test Username",
+    "test_password": "Test Password",
+    "test_success": "Connection successful",
+    "test_failed": "Connection failed"
   }
 }

frontend/messages/ja.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "ユーザー管理",
+    "ldap": "LDAP",
     "avatar": "アバター",
     "id": "ID",
     "email": "メールアドレス",
@@ -434,5 +435,27 @@
     "tag_error_create": "タグの作成に失敗しました。もう一度お試しください。",
     "tag_error_update": "タグの更新に失敗しました。もう一度お試しください。",
     "tag_error_delete": "タグの削除に失敗しました。もう一度お試しください。"
+  },
+  "Ldap": {
+    "ldap_settings": "LDAP 設定",
+    "ldap_description": "LDAP ディレクトリでユーザーを認証します。",
+    "enable_ldap": "LDAP を有効化",
+    "enable_ldap_desc": "ユーザーがディレクトリの資格情報でサインインできるようにします。",
+    "server_url": "サーバー URL",
+    "bind_dn": "バインド DN",
+    "bind_credentials": "バインドパスワード",
+    "bind_credentials_placeholder": "現在のパスワードを保持する場合は空欄",
+    "search_base": "検索ベース",
+    "search_filter": "検索フィルター",
+    "email_attribute": "メール属性",
+    "username_attribute": "ユーザー名属性",
+    "save": "保存",
+    "saved": "LDAP 設定を保存しました",
+    "save_error": "LDAP 設定の保存に失敗しました",
+    "test_connection": "接続テスト",
+    "test_username": "テストユーザー名",
+    "test_password": "テストパスワード",
+    "test_success": "接続に成功しました",
+    "test_failed": "接続に失敗しました"
   }
 }

frontend/messages/pt-BR.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "Gerenciamento de Usuários",
+    "ldap": "LDAP",
     "avatar": "Avatar",
     "id": "ID",
     "email": "E-mail",
@@ -434,5 +435,27 @@
     "tag_error_create": "Falha ao criar tag. Por favor, tente novamente.",
     "tag_error_update": "Falha ao atualizar tag. Por favor, tente novamente.",
     "tag_error_delete": "Falha ao excluir tag. Por favor, tente novamente."
+  },
+  "Ldap": {
+    "ldap_settings": "Configurações de LDAP",
+    "ldap_description": "Autenticar usuários em um diretório LDAP.",
+    "enable_ldap": "Ativar LDAP",
+    "enable_ldap_desc": "Permitir que os usuários entrem com suas credenciais do diretório.",
+    "server_url": "URL do servidor",
+    "bind_dn": "Bind DN",
+    "bind_credentials": "Senha de Bind",
+    "bind_credentials_placeholder": "Deixe em branco para manter a senha atual",
+    "search_base": "Base de busca",
+    "search_filter": "Filtro de busca",
+    "email_attribute": "Atributo de e-mail",
+    "username_attribute": "Atributo de nome de usuário",
+    "save": "Salvar",
+    "saved": "Configurações de LDAP salvas",
+    "save_error": "Falha ao salvar as configurações de LDAP",
+    "test_connection": "Testar conexão",
+    "test_username": "Usuário de teste",
+    "test_password": "Senha de teste",
+    "test_success": "Conexão bem-sucedida",
+    "test_failed": "Falha na conexão"
   }
 }

frontend/messages/zh-CN.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "用户管理",
+    "ldap": "LDAP",
     "avatar": "头像",
     "id": "ID",
     "email": "邮箱",
@@ -434,5 +435,27 @@
     "tag_error_create": "标签创建失败，请重试。",
     "tag_error_update": "标签更新失败，请重试。",
     "tag_error_delete": "标签删除失败，请重试。"
+  },
+  "Ldap": {
+    "ldap_settings": "LDAP 设置",
+    "ldap_description": "通过 LDAP 目录验证用户身份。",
+    "enable_ldap": "启用 LDAP",
+    "enable_ldap_desc": "允许用户使用目录凭据登录。",
+    "server_url": "服务器地址",
+    "bind_dn": "绑定 DN",
+    "bind_credentials": "绑定密码",
+    "bind_credentials_placeholder": "留空以保留当前密码",
+    "search_base": "搜索基准",
+    "search_filter": "搜索过滤器",
+    "email_attribute": "邮箱属性",
+    "username_attribute": "用户名属性",
+    "save": "保存",
+    "saved": "LDAP 设置已保存",
+    "save_error": "保存 LDAP 设置失败",
+    "test_connection": "测试连接",
+    "test_username": "测试用户名",
+    "test_password": "测试密码",
+    "test_success": "连接成功",
+    "test_failed": "连接失败"
   }
 }

frontend/messages/zh-TW.json

@@ -149,6 +149,7 @@
   },
   "Admin": {
     "user_management": "使用者管理",
+    "ldap": "LDAP",
     "avatar": "頭像",
     "id": "ID",
     "email": "電子郵件",
@@ -434,5 +435,27 @@
     "tag_error_create": "標籤建立失敗，請重試。",
     "tag_error_update": "標籤更新失敗，請重試。",
     "tag_error_delete": "標籤刪除失敗，請重試。"
+  },
+  "Ldap": {
+    "ldap_settings": "LDAP 設定",
+    "ldap_description": "透過 LDAP 目錄驗證使用者身分。",
+    "enable_ldap": "啟用 LDAP",
+    "enable_ldap_desc": "允許使用者使用目錄憑證登入。",
+    "server_url": "伺服器位址",
+    "bind_dn": "繫結 DN",
+    "bind_credentials": "繫結密碼",
+    "bind_credentials_placeholder": "留空以保留目前密碼",
+    "search_base": "搜尋基準",
+    "search_filter": "搜尋過濾器",
+    "email_attribute": "電子郵件屬性",
+    "username_attribute": "使用者名稱屬性",
+    "save": "儲存",
+    "saved": "已儲存 LDAP 設定",
+    "save_error": "儲存 LDAP 設定失敗",
+    "test_connection": "測試連線",
+    "test_username": "測試使用者名稱",
+    "test_password": "測試密碼",
+    "test_success": "連線成功",
+    "test_failed": "連線失敗"
   }
 }