feat(ldap): per-user exclude/denylist filter for sync

Add a per-username denylist so individual accounts (service accounts like
administrator, krbtgt, guest, ldap$) can be excluded from LDAP sync,
independent of the group/OU include-filter which only scopes the search.

- schema: LdapConfig.userExcludeList String[] (+ migration)
- sync: skip excluded usernames (case-insensitive) before recording the DN,
  so an already-imported user added to the list gets deactivated next sync
- DTO / config service / controller / scheduler: thread userExcludeList through
- web: exclude-list admin UI section (add/remove/save) + de/en translations
- tests: 3 specs covering empty list, case-insensitive skip, deactivation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/ldap/dto/ldap-config.dto.ts

@@ -46,6 +46,11 @@ export class CreateLdapConfigDto {
   @IsString({ each: true })
   @IsOptional()
   groupFilterDns?: string[];
+
+  @IsArray()
+  @IsString({ each: true })
+  @IsOptional()
+  userExcludeList?: string[];
 }
 
 /**