feat(16-05): wire full sync report + visible sync-request error (D-06, D-21)

- SyncResult interface grows additively: groupMembershipsAdded/Removed
  (D-21 backend gap, existed since Phase 15 but never wired into the
  frontend) plus groupsAdopted/Renamed/Deleted and defaultMarkerMoved
  (Plan 16-03).
- New syncRequestError state: a failed sync request (network error or
  !res.ok) now renders a visible text-sm text-destructive line instead
  of silently reporting a three-zero result as a successful no-op.
- Sync report container gains three new lines: group-membership counts,
  AD-group counts (always visible, even at zero), and a conditional
  amber "default marker reassigned" line shown only when
  defaultMarkerMoved > 0.
- Four new i18n keys under admin.ldap.sync in de.json/en.json.

apps/web/src/messages/de.json

@@ -329,7 +329,11 @@
         "neverSynced": "Noch nie synchronisiert",
         "trigger": "Jetzt synchronisieren",
         "syncing": "Synchronisiere...",
-        "result": "Erstellt: {created}, aktualisiert: {updated}, deaktiviert: {deactivated}"
+        "result": "Erstellt: {created}, aktualisiert: {updated}, deaktiviert: {deactivated}",
+        "resultGroupMemberships": "Gruppenmitgliedschaften: {groupMembershipsAdded} hinzugefügt, {groupMembershipsRemoved} entfernt",
+        "resultGroups": "AD-Gruppen: {groupsAdopted} neu übernommen, {groupsRenamed} umbenannt, {groupsDeleted} gelöscht",
+        "defaultMarkerMoved": "Standardgruppen-Markierung musste neu vergeben werden ({defaultMarkerMoved}×).",
+        "requestError": "Die Synchronisation konnte nicht ausgeführt werden."
       },
       "groupFilter": {
         "title": "Import-Filter (Gruppen/OUs)",