Add optional LDAP and Active Directory authentication

[bifrost0x]

Summary

• add optional LDAP and Active Directory authentication, disabled by default
• require explicit identity linking to an existing WebSSH account; no automatic provisioning or privilege mapping
• support certificate-verified StartTLS and LDAPS with bounded connection and operation timeouts
• keep bind credentials and the trusted CA bundle in a read-only runtime secret volume
• provide a dedicated Compose overlay, isolated secret helper, operator documentation, and a disposable OpenLDAP integration lab
• revalidate LDAP-managed sessions and preserve audit logging, rate limits, CSRF protection, and existing local account isolation
• present LDAP sign-in as an exclusive login mode with a clear back action instead of expanding it below other authentication methods

Deployment behavior

• the base Compose deployment does not start or mount LDAP infrastructure
• LDAP is enabled only through docker-compose.ldap.yml and complete operator-supplied settings
• the ldap-tools helper runs only when explicitly invoked through its profile
• disabled installations retain the existing login flow and do not load LDAP routes or background work

Verification

• 1,554 Python tests passed, 33 skipped
• 200 JavaScript unit tests passed
• 66 Playwright E2E tests passed
• vendored frontend integrity check passed
• JavaScript lint passed
• dependency lock check passed
• base, LDAP overlay, helper-profile, and production Compose resolution passed
• disposable StartTLS lab reported healthy readiness and completed a real linked-user login
• LDAP/default mode switching and the failed-login isolated state were verified in the live browser UI

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f050d58707

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".