feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/tests/conftest.py

@@ -3,8 +3,17 @@ import pytest
 
 @pytest.fixture
 def valid_env(tmp_path):
+    ca_file = tmp_path / "ca.pem"
+    ca_file.write_text("test ca")
     return {
         "SECRET_KEY": "x" * 48,
         "ALLOWED_HOSTS": "testserver",
         "DATA_DIR": str(tmp_path),
+        "LDAP_SERVER": "dc.example.test",
+        "LDAP_USER_OU_DN": "OU=Users,DC=example,DC=test",
+        "LDAP_BIND_DN": "svc@example.test",
+        "LDAP_BIND_PASSWORD": "service-password",
+        "LDAP_CA_FILE": str(ca_file),
+        "LDAP_PUBLISHER_GROUP_DN": "CN=Publishers,OU=Users,DC=example,DC=test",
+        "LDAP_ADMIN_GROUP_DN": "CN=Admins,OU=Users,DC=example,DC=test",
     }