feat(260728-lih): default LDAP syncIntervalMin to 0 (auto-sync off)

- LdapConfig.syncIntervalMin default changed 60 -> 0
- New migration sets column DEFAULT only, no data rewrite
- isActive @default(true) left unchanged (gates LDAP login only)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/prisma/migrations/20260728134010_ldap_sync_interval_default_off/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "LdapConfig" ALTER COLUMN "syncIntervalMin" SET DEFAULT 0;

apps/api/prisma/schema.prisma

@@ -67,7 +67,7 @@ model LdapConfig {
   bindDn          String?
   bindPassword    String?
   searchFilter    String             @default("(objectClass=person)")
-  syncIntervalMin Int                @default(60)
+  syncIntervalMin Int                @default(0)
   isActive        Boolean            @default(true)
   tlsRejectUnauthorized Boolean       @default(true)
   groupFilterDns  String[]           @default([])