feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/directory/__init__.py

@@ -0,0 +1,31 @@
+"""Directory adapter: the only code that talks to Active Directory (AD-1)."""
+
+from .base import (
+    READABLE_ATTRIBUTES,
+    WRITABLE_ATTRIBUTES,
+    Directory,
+    DirectoryError,
+    DirectoryUnavailable,
+    DirectoryUser,
+    Forbidden,
+    PasswordPolicy,
+    PasswordRejected,
+    ValidationFailed,
+)
+from .fake import FakeDirectory
+from .ldap_directory import LdapDirectory
+
+__all__ = [
+    "READABLE_ATTRIBUTES",
+    "WRITABLE_ATTRIBUTES",
+    "Directory",
+    "DirectoryError",
+    "DirectoryUnavailable",
+    "DirectoryUser",
+    "FakeDirectory",
+    "Forbidden",
+    "LdapDirectory",
+    "PasswordPolicy",
+    "PasswordRejected",
+    "ValidationFailed",
+]