Add safe LDAP auto-provisioning

[bifrost0x]

Summary

• add an Authentication Source selector for local and LDAP password sign-in
• add opt-in LDAP auto-provisioning with break-glass and identity-collision safeguards
• harden the test suite against live deployment data and external service targets
• document the configuration and cover login, provisioning, CLI, and concurrency behavior

Context

Discussion #110 proposes making LDAP a first-class password authentication source and optionally creating directory-managed users on their first successful sign-in. Existing deployments retain explicit account linking by default.

Behavior

• LDAP remains opt-in, and LDAP_AUTO_PROVISION defaults to false
• auto-provisioning happens only after a successful directory bind and requires an active local break-glass administrator
• local and directory usernames are casefold-unique, with creation serialized across SQLite connections
• LDAP-managed users cannot be promoted through create-admin
• pytest isolates data, transfer, and backup paths and disables deployment authentication and rate-limit services before collection
• real Redis tests require a loopback URL with an explicit non-zero database and delete only their unique rate-limit bucket
• Paramiko integration tests accept only the exact disposable OpenSSH lab targets produced by the repository runner
• no database migration is required

Validation

• pytest tests -q - 1,585 passed, 33 skipped
• npm run vendor:check - passed
• npm run lint:js - passed
• npm run test:js - 200 passed
• docker compose -f docker-compose.yml -f docker-compose.ldap.yml config --quiet - passed
• disposable OpenLDAP login flow exercised locally

Implements the direction discussed in #110.