feat: add LDAP authentication settings and toggle

Add an admin-only LDAP configuration UI with an enable toggle and full
sign-in integration.

Backend:
- ldapSettings model + migration (single-row config)
- GET/PUT/test routes under /ldap (admin-gated; bind password masked)
- shared ldapClient with RFC 4515 filter escaping and empty-password guard
- signin tries local auth first, then LDAP when enabled (find-or-create
  local user) so the bootstrap admin is never locked out

Frontend:
- LDAP settings page (Switch + form + test connection) under /admin/ldap
- AdminNav tabs between user management and LDAP
- ldapControl util, types, and Ldap i18n namespace for all 6 locales

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/types/ldap.ts

@@ -0,0 +1,36 @@
+export type LdapSettingsType = {
+  enabled: boolean;
+  url: string;
+  bindDn: string;
+  bindCredentials: string;
+  bindCredentialsSet?: boolean;
+  searchBase: string;
+  searchFilter: string;
+  emailAttribute: string;
+  usernameAttribute: string;
+};
+
+export type LdapMessages = {
+  userManagement: string;
+  ldap: string;
+  ldapSettings: string;
+  ldapDescription: string;
+  enableLdap: string;
+  enableLdapDesc: string;
+  serverUrl: string;
+  bindDn: string;
+  bindCredentials: string;
+  bindCredentialsPlaceholder: string;
+  searchBase: string;
+  searchFilter: string;
+  emailAttribute: string;
+  usernameAttribute: string;
+  save: string;
+  saved: string;
+  saveError: string;
+  testConnection: string;
+  testUsername: string;
+  testPassword: string;
+  testSuccess: string;
+  testFailed: string;
+};