feat(02-04): LdapModule with sync service, config service, scheduler, and controller

- LdapService uses ldapts for DIRECTORY SYNC ONLY (anti-pattern avoidance)
- LdapConfigService creates default field mappings per D-16 (displayName, mail, sAMAccountName)
- Custom field mappings can be added/removed per D-17
- Per-tenant LDAP config per D-18
- syncUsersForTenant deactivates users removed from LDAP per D-15
- LdapSyncScheduler sets tenant context explicitly per Pitfall 2
- Manual sync endpoint POST /ldap/sync per D-14
- Auto-sync cron checks syncIntervalMin per D-14
- Test connection endpoint for LDAP config validation
- OpenLDAP + phpLDAPadmin added to docker-compose.dev.yml
- LDAP search filter sanitization per T-02-16
- bindPassword never returned in API responses per T-02-17

apps/api/src/ldap/ldap.module.ts

@@ -0,0 +1,21 @@
+import { Module } from '@nestjs/common';
+import { ScheduleModule } from '@nestjs/schedule';
+import { UserModule } from '../user/user.module';
+import { LdapConfigService } from './ldap-config.service';
+import { LdapSyncScheduler } from './ldap-sync.scheduler';
+import { LdapController } from './ldap.controller';
+import { LdapService } from './ldap.service';
+
+/**
+ * LDAP Module - Directory sync for user import (AUTH-06).
+ *
+ * Provides per-tenant LDAP configuration (D-18), manual sync (D-14),
+ * auto-sync scheduler (D-14), and configurable field mapping (D-16/D-17).
+ */
+@Module({
+  imports: [ScheduleModule.forRoot(), UserModule],
+  controllers: [LdapController],
+  providers: [LdapService, LdapConfigService, LdapSyncScheduler],
+  exports: [LdapService],
+})
+export class LdapModule {}