LDAP admin GUI + group filter

- LDAP settings configurable from Admin panel (no restart needed)
- Required group filter: only users in specified group can login
- Supports both memberOf attribute and groupOfNames search
- Settings stored in DB (settings table), env vars as fallback
- SLDAP supported via ldaps:// URL
- Bind password masked in UI

internal/api/handlers.go

@@ -95,7 +95,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 
 	// Try LDAP if local auth failed
 	if !localAuthOK {
-		ldapCfg := auth.LDAPConfigFromEnv()
+		ldapCfg := auth.LDAPConfigFromDB(s.db)
 		if ldapCfg != nil {
 			email, displayName, ldapErr := auth.LDAPAuth(ldapCfg, req.Email, req.Password)
 			if ldapErr == nil {