LDAP admin GUI + group filter

- LDAP settings configurable from Admin panel (no restart needed)
- Required group filter: only users in specified group can login
- Supports both memberOf attribute and groupOfNames search
- Settings stored in DB (settings table), env vars as fallback
- SLDAP supported via ldaps:// URL
- Bind password masked in UI

internal/db/db.go

@@ -43,6 +43,10 @@ func Migrate(database *DB) error {
 		detail TEXT,
 		created_at TEXT NOT NULL DEFAULT (datetime('now'))
 	)`)
+	database.Exec(`CREATE TABLE IF NOT EXISTS settings (
+		key TEXT PRIMARY KEY,
+		value TEXT NOT NULL
+	)`)
 	return nil
 }