feat(ldap): per-user exclude/denylist filter for sync

Add a per-username denylist so individual accounts (service accounts like
administrator, krbtgt, guest, ldap$) can be excluded from LDAP sync,
independent of the group/OU include-filter which only scopes the search.

- schema: LdapConfig.userExcludeList String[] (+ migration)
- sync: skip excluded usernames (case-insensitive) before recording the DN,
  so an already-imported user added to the list gets deactivated next sync
- DTO / config service / controller / scheduler: thread userExcludeList through
- web: exclude-list admin UI section (add/remove/save) + de/en translations
- tests: 3 specs covering empty list, case-insensitive skip, deactivation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/ldap/ldap-sync.scheduler.ts

@@ -65,6 +65,7 @@ export class LdapSyncScheduler {
             bindPassword: config.bindPassword,
             searchFilter: config.searchFilter,
             groupFilterDns: config.groupFilterDns,
+            userExcludeList: config.userExcludeList,
             fieldMappings: config.fieldMappings,
           },
           config.tenantId,