feat(ldap): allow testing connection before saving a config

"Verbindung testen" only appeared after a config was already saved,
so a fresh/never-configured tenant had no way to validate connection
details at all. Now the button is always visible; POST /ldap/test-connection
accepts optional ad-hoc serverUrl/bindDn/bindPassword and falls back
field-by-field to the saved config for anything omitted (bindPassword
in particular, since the form never re-sends the masked saved password).

Verified locally: tested with typed-but-unsaved values (base DN left
blank, nothing saved) and got a real connection attempt/error back,
not a 404 "no config" response.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -53,6 +53,25 @@ export class CreateLdapConfigDto {
  */
 export class UpdateLdapConfigDto extends PartialType(CreateLdapConfigDto) {}
 
+/**
+ * DTO for testing a connection with ad-hoc (not-yet-saved) values, so an
+ * admin can validate server/bindDn/bindPassword before persisting a config.
+ * When omitted, the controller falls back to the tenant's saved config.
+ */
+export class TestConnectionDto {
+  @IsUrl({ protocols: ['ldap', 'ldaps'], require_tld: false })
+  @IsOptional()
+  serverUrl?: string;
+
+  @IsString()
+  @IsOptional()
+  bindDn?: string;
+
+  @IsString()
+  @IsOptional()
+  bindPassword?: string;
+}
+
 /**
  * DTO for creating a field mapping entry (D-17).
  */