feat(16-05): wire full sync report + visible sync-request error (D-06, D-21)

- SyncResult interface grows additively: groupMembershipsAdded/Removed
  (D-21 backend gap, existed since Phase 15 but never wired into the
  frontend) plus groupsAdopted/Renamed/Deleted and defaultMarkerMoved
  (Plan 16-03).
- New syncRequestError state: a failed sync request (network error or
  !res.ok) now renders a visible text-sm text-destructive line instead
  of silently reporting a three-zero result as a successful no-op.
- Sync report container gains three new lines: group-membership counts,
  AD-group counts (always visible, even at zero), and a conditional
  amber "default marker reassigned" line shown only when
  defaultMarkerMoved > 0.
- Four new i18n keys under admin.ldap.sync in de.json/en.json.

apps/web/src/messages/en.json

@@ -329,7 +329,11 @@
         "neverSynced": "Never synced",
         "trigger": "Sync now",
         "syncing": "Syncing...",
-        "result": "Created: {created}, updated: {updated}, deactivated: {deactivated}"
+        "result": "Created: {created}, updated: {updated}, deactivated: {deactivated}",
+        "resultGroupMemberships": "Group memberships: {groupMembershipsAdded} added, {groupMembershipsRemoved} removed",
+        "resultGroups": "AD groups: {groupsAdopted} newly adopted, {groupsRenamed} renamed, {groupsDeleted} deleted",
+        "defaultMarkerMoved": "Default-group marker had to be reassigned ({defaultMarkerMoved}×).",
+        "requestError": "The synchronization could not be run."
       },
       "groupFilter": {
         "title": "Import filter (groups/OUs)",