feat(ldap): individual user search + selective import with dedup

Add an AD single-user search (by cn/sAMAccountName/displayName/mail) and a
selective import to the LDAP admin page, alongside the existing group/OU
filter. Imported users are deduped against existing ones by (ldapDn, then
username): a manually-imported user carries its ldapDn, so a later
department/group sync matches and updates it in place instead of creating a
duplicate. Search results flag alreadyImported; import skips existing users
and links a missing ldapDn. Extracted shared mapEntry/upsertMappedUser
helpers so sync and manual import resolve identity identically.

Backend: GET /ldap/users/search, POST /ldap/users/import (RFC-4515 escaped
query, ADMIN-guarded). 6 new service specs (search flags, create, skip,
ldapDn-link, denylist). Full API suite 215 green, both apps tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/web/src/messages/de.json

@@ -334,6 +334,19 @@
         "excluded": "Ausgeschlossen",
         "empty": "Keine ausgeschlossen - alle gefundenen Benutzer werden importiert.",
         "save": "Ausschlussliste speichern"
+      },
+      "userSearch": {
+        "title": "Einzelbenutzer suchen & importieren",
+        "description": "Sucht einzelne AD-Benutzer und importiert sie gezielt. Bereits vorhandene Benutzer werden uebersprungen - kein Doppelimport, auch wenn spaeter die Abteilung synchronisiert wird.",
+        "placeholder": "Name, Benutzername oder E-Mail...",
+        "search": "Suchen",
+        "noResults": "Keine Benutzer gefunden.",
+        "alreadyImported": "Bereits importiert",
+        "import": "Importieren",
+        "importSelected": "Ausgewaehlte importieren",
+        "created": "importiert",
+        "skipped": "uebersprungen",
+        "errors": "Fehler"
       }
     }
   },