feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/config/settings.py

@@ -23,6 +23,7 @@ ALLOWED_HOSTS = _config.allowed_hosts
 TRUSTED_PROXIES = _config.trusted_proxies
 DATA_DIR = _config.data_dir
 DISPLAY_TIME_ZONE = _config.default_timezone
+DIRECTORY = _config.directory
 
 INSTALLED_APPS = [
     "django.contrib.contenttypes",