feat(ldap): per-user exclude/denylist filter for sync

Add a per-username denylist so individual accounts (service accounts like
administrator, krbtgt, guest, ldap$) can be excluded from LDAP sync,
independent of the group/OU include-filter which only scopes the search.

- schema: LdapConfig.userExcludeList String[] (+ migration)
- sync: skip excluded usernames (case-insensitive) before recording the DN,
  so an already-imported user added to the list gets deactivated next sync
- DTO / config service / controller / scheduler: thread userExcludeList through
- web: exclude-list admin UI section (add/remove/save) + de/en translations
- tests: 3 specs covering empty list, case-insensitive skip, deactivation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/prisma/schema.prisma

@@ -70,6 +70,7 @@ model LdapConfig {
   syncIntervalMin Int                @default(60)
   isActive        Boolean            @default(true)
   groupFilterDns  String[]           @default([])
+  userExcludeList String[]           @default([])
   lastSyncAt      DateTime?
   createdAt       DateTime           @default(now())
   updatedAt       DateTime           @updatedAt