feat: add directory adapter

LDAPS directory adapter with certificate verification, allow-listed reads and
writes, escaped filters, password verification and change, password policy
and account state, plus an in-memory fake. Adds the LDAP_* configuration,
python-ldap with its image libraries, the CA file mount and an opt-in live
test for the test OU.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

pyproject.toml

@@ -9,6 +9,7 @@ dependencies = [
     "gunicorn>=23.0",
     "whitenoise>=6.9",
     "tzdata",
+    "python-ldap>=3.4.4",
 ]
 
 [dependency-groups]
@@ -29,6 +30,13 @@ env = [
     "DATA_DIR=.",
     "DEBUG=false",
     "LOG_LEVEL=INFO",
+    "LDAP_SERVER=dc.example.test",
+    "LDAP_USER_OU_DN=OU=Users,DC=example,DC=test",
+    "LDAP_BIND_DN=svc@example.test",
+    "LDAP_BIND_PASSWORD=test-only-service-password",
+    "LDAP_CA_FILE=pyproject.toml",
+    "LDAP_PUBLISHER_GROUP_DN=CN=Publishers,OU=Users,DC=example,DC=test",
+    "LDAP_ADMIN_GROUP_DN=CN=Admins,OU=Users,DC=example,DC=test",
 ]
 
 [tool.ruff]