feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

Dockerfile

@@ -4,6 +4,9 @@ FROM python:3.13-slim AS builder
 COPY --from=ghcr.io/astral-sh/uv:0.13.1 /uv /usr/local/bin/uv
 ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
 WORKDIR /app
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential libldap2-dev libsasl2-dev \
+    && rm -rf /var/lib/apt/lists/*
 COPY pyproject.toml uv.lock .python-version README.md ./
 RUN uv sync --frozen --no-dev --no-install-project
 COPY manage.py ./
@@ -11,11 +14,16 @@ COPY portal ./portal
 # Build-time only values so collectstatic can load settings; not used at runtime.
 RUN SECRET_KEY=build-time-only-value-not-used-at-runtime-000000 \
     ALLOWED_HOSTS=localhost DATA_DIR=/tmp \
+    LDAP_SERVER=build.invalid LDAP_USER_OU_DN=build LDAP_BIND_DN=build LDAP_BIND_PASSWORD=build \
+    LDAP_CA_FILE=/app/README.md LDAP_PUBLISHER_GROUP_DN=build LDAP_ADMIN_GROUP_DN=build \
     /app/.venv/bin/python manage.py collectstatic --noinput
 
 FROM python:3.13-slim
 ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PATH="/app/.venv/bin:$PATH"
-RUN useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin app \
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libldap2 libsasl2-2 \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --uid 10001 --no-create-home --shell /usr/sbin/nologin app \
     && mkdir /data /backups \
     && chown app:app /data /backups
 WORKDIR /app