feat(ldap): add groupFilterDns column for selective import filter

Persists per-tenant AD group/OU DNs to restrict which directory
entries get synced. Empty array (default) preserves current
behavior — import everyone under base DN.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -1,5 +1,6 @@
 import { PartialType } from '@nestjs/mapped-types';
 import {
+  IsArray,
   IsBoolean,
   IsInt,
   IsNotEmpty,
@@ -40,6 +41,11 @@ export class CreateLdapConfigDto {
   @IsBoolean()
   @IsOptional()
   isActive?: boolean = true;
+
+  @IsArray()
+  @IsString({ each: true })
+  @IsOptional()
+  groupFilterDns?: string[] = [];
 }
 
 /**