feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

.env.example

@@ -7,6 +7,29 @@ SECRET_KEY=
 # Required. Comma-separated host names the portal answers to.
 ALLOWED_HOSTS=portal.example.test
 
+# Required. Host name of the directory server; LDAPS (port 636) is always used.
+# Must match a name in the server's certificate. Add :port to use another port.
+LDAP_SERVER=
+
+# Required. Distinguished name of the OU whose users the portal may read and change.
+LDAP_USER_OU_DN=
+
+# Required. The service account, as a distinguished name or user principal name.
+LDAP_BIND_DN=
+LDAP_BIND_PASSWORD=
+
+# Required. Path inside the container of the PEM file with the CA chain that signed the
+# directory server's certificate. Mount the file read-only, for example at /certs/ca.pem.
+LDAP_CA_FILE=/certs/ca.pem
+
+# Required for docker compose. Path on the Docker host of the CA chain file; compose mounts it
+# read-only at /certs/ca.pem. (Only compose reads this; the portal does not.)
+CA_FILE_HOST=
+
+# Required. Distinguished names of the groups that grant the Publisher and Admin roles.
+LDAP_PUBLISHER_GROUP_DN=
+LDAP_ADMIN_GROUP_DN=
+
 # Optional. Directory for the database. Default /data (the container volume).
 # DATA_DIR=/data