feat(auth): LDAP login — authenticate imported users against the directory

LDAP-imported users have no local passwordHash, and validateUser only checked
the local password, so they could never log in. Now a passwordless user with
an ldapDn is authenticated by binding as their OWN DN with the entered
password against the tenant's active LDAP config (reusing the ldaps TLS-skip
option). Empty passwords are rejected before binding to avoid AD's
unauthenticated-bind bypass. Local-password users are unchanged.

LdapService.verifyUserCredentials added; LdapModule now exports
LdapConfigService; AuthModule imports LdapModule (no circular dep). 8 new
specs (bind success/fail, empty-password guard, login via bind, wrong pw, no
config, no ldapDn, inactive). API 226 green, tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/ldap/ldap.module.ts

@@ -16,6 +16,6 @@ import { LdapService } from './ldap.service';
   imports: [ScheduleModule.forRoot(), UserModule],
   controllers: [LdapController],
   providers: [LdapService, LdapConfigService, LdapSyncScheduler],
-  exports: [LdapService],
+  exports: [LdapService, LdapConfigService],
 })
 export class LdapModule {}