feat(auth): add LDAP and Active Directory adapter

[XiaoSeS]

Summary

• add a dedicated LDAP/Active Directory credential adapter for the unified identity core
• support service search plus user bind, OpenLDAP entryUUID, AD objectGUID, LDAPS and StartTLS
• add bounded timeouts, escaped filters, safe failure codes, low-cardinality metrics and secret-safe configuration
• add default-off Compose, Helm and Kustomize configuration plus operator documentation

Identity and security

• no email, username or DN based implicit account linking
• LDAP network I/O completes before the unified identity database transaction
• ordinary LDAP mail stays provider-asserted; an explicit trusted provider capability is required for authoritative email
• production release configuration rejects plain LDAP and insecure testing mode
• bind password is sourced from environment or Kubernetes Secret, never ConfigMap

Verification completed

• 42 targeted auth/provider tests passed
• full skillhub-app reactor compilation passed
• release configuration contract tests passed
• Docker Compose release configuration rendered
• Helm strict lint and configuration contract tests passed with Helm 3.19.0
• Kustomize base rendered

Remaining Draft gates

• full backend/web/staging regression
• exact feature SHA integration into big-main
• revision-labelled image and isolated Hong Kong test-machine validation with real OpenLDAP

Closes #671
Refs #628, #260, #437

This PR targets big-main only. It must not be merged to main without explicit maintainer confirmation.

[FenjuFu]

Heads-up on a collision: #437 (@jangrui) and this PR both implement enterprise LDAP/AD login, and they'd conflict if both landed.

• feat(auth): 企业 LDAP 登录与身份绑定 #437 (opened 2026-05-14, based on the earlier 新增支持LDAP登录https://github.com/iflytek/skillhub/issues/260 #283): a standalone LdapAuthController + LdapBindingAppService, LDAP as a fallback after local auth fails, with an explicit bind endpoint (POST /api/v1/auth/ldap/bind) for the email-collision case.
• This PR feat(auth): add LDAP and Active Directory adapter #672 (2026-07-31): LDAP/AD as a credential adapter inside the unified identity core (DirectAuthService), part of the federation architecture in docs(auth): define unified identity federation architecture #630.

Both handle OpenLDAP entryUUID / AD objectGUID and both refuse silent email merge (409), so they solve the same problem two different ways — one as a self-contained feature, one as a piece of the broader identity model.

This needs a maintainer to pick the lane before either merges, otherwise it's duplicated work plus a fork in the auth architecture. @dongjiang1989 — which direction do you want LDAP to take: the standalone #437, or folded into the federation core here? Whoever isn't chosen can likely contribute their edge-case handling (the explicit-bind endpoint in #437 is a nice touch) into the winning PR rather than being wasted.

Not casting a vote on the direction — flagging so the two efforts converge instead of racing.

[XiaoSeS]

Maintainer validation update:

• PR feat(auth): add LDAP and Active Directory adapter #672 is integrated into big-main; main was not modified.
• Follow-up smoke fix 486fc642a51c4fa331acbee67e3f0f5a14ebccd3 is authored and committed by XiaoSeS, with DCO sign-off. It refreshes the anonymous session/CSRF token after logout so repeat LDAP login does not produce a false 401.
• Tested integration: a34018fcc7232eca06e63e1c281fb874d863e5b8.
• Hong Kong isolated validation passed: health, provider catalog, first/repeat login, logout, invalid credentials, unknown identity, response redaction, stable platform identity after a real LDAP uid rename, and application-log secret scan.
• The existing 8080 runtime kept the same image and remained healthy; all run-owned test resources were removed afterward.

Promotion from big-main to main remains a separate maintainer-confirmation step.