feat(260729-d3k): multi-line Base-DN textarea + reworked scope i18n

- Base-DN admin field is now a multi-line textarea (one DN per line),
  value stays a single newline-separated string, no schema change
- baseDnHint key added (de/en) explaining the Base-DN(s) sync scope
- groupFilter.description/emptyMeansAll reworded: group filter is an
  optional extra restriction; empty selection means all users under
  the base DN(s) are synced (drops the old "nothing is synced"
  framing)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/web/src/messages/en.json

@@ -284,6 +284,7 @@
       "connectionTitle": "Connection settings",
       "serverUrl": "Server URL",
       "baseDn": "Base DN",
+      "baseDnHint": "One DN per line. The base DN(s) define the sync scope.",
       "bindDn": "Bind DN",
       "bindPassword": "Bind password",
       "searchFilter": "Search filter",
@@ -317,7 +318,7 @@
       },
       "groupFilter": {
         "title": "Import filter (groups/OUs)",
-        "description": "Restrict sync to selected AD groups or organizational units. With no selection, nothing is synced.",
+        "description": "Optional additional restriction to selected AD groups or organizational units. With no selection, all users under the base DN(s) are synced.",
         "discover": "Discover groups/OUs",
         "typeOu": "OU",
         "typeGroup": "Group",
@@ -327,7 +328,7 @@
         "manualDn": "Add DN manually",
         "addDn": "Add",
         "selected": "Selected",
-        "emptyMeansAll": "No selection - nothing is synced.",
+        "emptyMeansAll": "No selection - all users under the base DN(s) are synced.",
         "save": "Save filter"
       },
       "userExclude": {