feat(ldap): opt-in skip TLS verification for ldaps (internal CA)

Add a per-tenant "Skip TLS certificate verification" toggle to the LDAP
admin page so admins can connect to an AD whose ldaps:// certificate is
signed by an internal/self-signed CA (Node error: "unable to verify the
first certificate"). When enabled, ldapts is given
tlsOptions.rejectUnauthorized=false; the flag is ignored for plain ldap://
(no TLS). Defaults to full verification.

New Boolean column LdapConfig.tlsRejectUnauthorized (@default(true)) +
migration; wired through DTOs, config service, all Client creations
(test/groups/user-search/import/sync) and the test-connection endpoint. UI
checkbox with an insecure-network warning (de/en). 3 new service specs;
API 218 green, web 131 green, both apps tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/web/src/messages/de.json

@@ -287,6 +287,10 @@
       "bindDn": "Bind-DN",
       "bindPassword": "Bind-Passwort",
       "searchFilter": "Suchfilter",
+      "tlsSkip": {
+        "label": "TLS-Zertifikat nicht pruefen (unsicher)",
+        "hint": "Nur fuer ldaps:// noetig, wenn das AD-Zertifikat von einer internen/selbstsignierten CA stammt (Fehler: 'unable to verify the first certificate'). Deaktiviert die Zertifikatspruefung - nur in vertrauenswuerdigen Netzen verwenden."
+      },
       "save": "Speichern",
       "testConnection": "Verbindung testen",
       "testSuccess": "Verbindung erfolgreich",