feat(ldap): per-user exclude/denylist filter for sync

Add a per-username denylist so individual accounts (service accounts like
administrator, krbtgt, guest, ldap$) can be excluded from LDAP sync,
independent of the group/OU include-filter which only scopes the search.

- schema: LdapConfig.userExcludeList String[] (+ migration)
- sync: skip excluded usernames (case-insensitive) before recording the DN,
  so an already-imported user added to the list gets deactivated next sync
- DTO / config service / controller / scheduler: thread userExcludeList through
- web: exclude-list admin UI section (add/remove/save) + de/en translations
- tests: 3 specs covering empty list, case-insensitive skip, deactivation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/ldap/ldap-config.service.ts

@@ -40,6 +40,7 @@ export class LdapConfigService {
         syncIntervalMin: dto.syncIntervalMin ?? 60,
         isActive: dto.isActive ?? true,
         groupFilterDns: dto.groupFilterDns ?? [],
+        userExcludeList: dto.userExcludeList ?? [],
         fieldMappings: {
           create: [
             {
@@ -83,6 +84,9 @@ export class LdapConfigService {
         ...(dto.groupFilterDns !== undefined && {
           groupFilterDns: dto.groupFilterDns,
         }),
+        ...(dto.userExcludeList !== undefined && {
+          userExcludeList: dto.userExcludeList,
+        }),
       },
       include: { fieldMappings: true },
     });