feat(260729-d3k): multi-line Base-DN textarea + reworked scope i18n

- Base-DN admin field is now a multi-line textarea (one DN per line),
  value stays a single newline-separated string, no schema change
- baseDnHint key added (de/en) explaining the Base-DN(s) sync scope
- groupFilter.description/emptyMeansAll reworded: group filter is an
  optional extra restriction; empty selection means all users under
  the base DN(s) are synced (drops the old "nothing is synced"
  framing)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/web/src/app/(portal)/admin/ldap/page.tsx

@@ -463,14 +463,15 @@ export default function AdminLdapPage() {
               <label className="text-sm font-medium text-foreground">
                 {t('baseDn')}
               </label>
-              <input
-                type="text"
+              <textarea
                 value={formData.baseDn}
                 onChange={(e) => setFormData({ ...formData, baseDn: e.target.value })}
-                placeholder="dc=example,dc=com"
-                className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm"
+                placeholder={'dc=example,dc=com\nou=extern,dc=example,dc=com'}
+                rows={3}
+                className="flex min-h-20 w-full rounded-md border border-input bg-background px-3 py-2 text-sm"
                 required
               />
+              <p className="text-xs text-muted-foreground">{t('baseDnHint')}</p>
             </div>
             <div className="space-y-2">
               <label className="text-sm font-medium text-foreground">

apps/web/src/messages/de.json

@@ -284,6 +284,7 @@
       "connectionTitle": "Verbindungseinstellungen",
       "serverUrl": "Server-URL",
       "baseDn": "Basis-DN",
+      "baseDnHint": "Ein DN pro Zeile. Die Basis-DN(s) legen den Umfang der Synchronisation fest.",
       "bindDn": "Bind-DN",
       "bindPassword": "Bind-Passwort",
       "searchFilter": "Suchfilter",
@@ -317,7 +318,7 @@
       },
       "groupFilter": {
         "title": "Import-Filter (Gruppen/OUs)",
-        "description": "Beschraenkt den Sync auf ausgewaehlte AD-Gruppen oder Organisationseinheiten. Ohne Auswahl wird nichts synchronisiert.",
+        "description": "Optionale zusaetzliche Einschraenkung auf ausgewaehlte AD-Gruppen oder Organisationseinheiten. Ohne Auswahl werden alle Benutzer unter den Basis-DN(s) synchronisiert.",
         "discover": "Gruppen/OUs suchen",
         "typeOu": "OU",
         "typeGroup": "Gruppe",
@@ -327,7 +328,7 @@
         "manualDn": "DN manuell hinzufuegen",
         "addDn": "Hinzufuegen",
         "selected": "Ausgewaehlt",
-        "emptyMeansAll": "Keine Auswahl - es wird nichts synchronisiert.",
+        "emptyMeansAll": "Keine Auswahl - alle Benutzer unter den Basis-DN(s) werden synchronisiert.",
         "save": "Filter speichern"
       },
       "userExclude": {

apps/web/src/messages/en.json

@@ -284,6 +284,7 @@
       "connectionTitle": "Connection settings",
       "serverUrl": "Server URL",
       "baseDn": "Base DN",
+      "baseDnHint": "One DN per line. The base DN(s) define the sync scope.",
       "bindDn": "Bind DN",
       "bindPassword": "Bind password",
       "searchFilter": "Search filter",
@@ -317,7 +318,7 @@
       },
       "groupFilter": {
         "title": "Import filter (groups/OUs)",
-        "description": "Restrict sync to selected AD groups or organizational units. With no selection, nothing is synced.",
+        "description": "Optional additional restriction to selected AD groups or organizational units. With no selection, all users under the base DN(s) are synced.",
         "discover": "Discover groups/OUs",
         "typeOu": "OU",
         "typeGroup": "Group",
@@ -327,7 +328,7 @@
         "manualDn": "Add DN manually",
         "addDn": "Add",
         "selected": "Selected",
-        "emptyMeansAll": "No selection - nothing is synced.",
+        "emptyMeansAll": "No selection - all users under the base DN(s) are synced.",
         "save": "Save filter"
       },
       "userExclude": {