feat(ldap): allow testing connection before saving a config

"Verbindung testen" only appeared after a config was already saved,
so a fresh/never-configured tenant had no way to validate connection
details at all. Now the button is always visible; POST /ldap/test-connection
accepts optional ad-hoc serverUrl/bindDn/bindPassword and falls back
field-by-field to the saved config for anything omitted (bindPassword
in particular, since the form never re-sends the masked saved password).

Verified locally: tested with typed-but-unsaved values (base DN left
blank, nothing saved) and got a real connection attempt/error back,
not a 404 "no config" response.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/src/app/(portal)/admin/ldap/page.tsx

@@ -155,13 +155,26 @@ export default function AdminLdapPage() {
   const handleTestConnection = async () => {
     setTestResult(null);
     try {
+      // Send the currently entered values so a connection can be validated
+      // before ever saving a config. bindPassword is omitted when blank so
+      // the backend falls back to the saved config's password (masked
+      // fields never get re-sent once a config already exists).
+      const body: Record<string, string> = {};
+      if (formData.serverUrl) body.serverUrl = formData.serverUrl;
+      if (formData.bindDn) body.bindDn = formData.bindDn;
+      if (formData.bindPassword) body.bindPassword = formData.bindPassword;
+
       const res = await fetch(`${API_URL}/ldap/test-connection`, {
         method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
         credentials: 'include',
+        body: JSON.stringify(body),
       });
+      const data = await res.json();
       if (res.ok) {
-        const data = await res.json();
         setTestResult(data);
+      } else {
+        setTestResult({ success: false, error: data.message || 'Test failed' });
       }
     } catch {
       setTestResult({ success: false, error: 'Network error' });
@@ -376,15 +389,17 @@ export default function AdminLdapPage() {
             >
               {saving ? tCommon('loading') : t('save')}
             </button>
-            {config && (
-              <button
-                type="button"
-                onClick={handleTestConnection}
-                className="rounded-md border border-border px-4 py-2 text-sm font-medium text-foreground hover:bg-muted transition-colors"
-              >
-                {t('testConnection')}
-              </button>
-            )}
+            <button
+              type="button"
+              onClick={handleTestConnection}
+              disabled={
+                !config &&
+                !(formData.serverUrl && formData.bindDn && formData.bindPassword)
+              }
+              className="rounded-md border border-border px-4 py-2 text-sm font-medium text-foreground hover:bg-muted transition-colors disabled:opacity-50"
+            >
+              {t('testConnection')}
+            </button>
           </div>
 
           {testResult && (