feat(ldap): add groupFilterDns column for selective import filter

Persists per-tenant AD group/OU DNs to restrict which directory
entries get synced. Empty array (default) preserves current
behavior — import everyone under base DN.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/prisma/migrations/20260707090000_add_ldap_group_filter/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LdapConfig" ADD COLUMN IF NOT EXISTS "groupFilterDns" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];

apps/api/prisma/schema.prisma

@@ -69,6 +69,7 @@ model LdapConfig {
   searchFilter    String             @default("(objectClass=person)")
   syncIntervalMin Int                @default(60)
   isActive        Boolean            @default(true)
+  groupFilterDns  String[]           @default([])
   lastSyncAt      DateTime?
   createdAt       DateTime           @default(now())
   updatedAt       DateTime           @updatedAt