Add LDAP authentication

- LDAP bind + search auth with auto-create local user
- Falls back to local auth if LDAP not configured or fails
- Configurable via MH_LDAP_* environment variables
- Supports ldap:// and ldaps:// with optional TLS skip
- go-ldap/ldap/v3 dependency added

INSTALL.md

@@ -43,6 +43,12 @@ Open `http://your-host:8080` and log in with the admin credentials above.
 | `MH_AI_ENDPOINT` | No | — | LiteLLM/OpenAI-compatible API URL for AI features |
 | `MH_AI_API_KEY` | No | — | API key for AI endpoint |
 | `MH_AI_MODEL` | No | `gpt-4` | Default model name |
+| `MH_LDAP_URL` | No | — | LDAP server URL (e.g. `ldap://ldap.example.com:389`) |
+| `MH_LDAP_BIND_DN` | No | — | Service account DN for user search |
+| `MH_LDAP_BIND_PASS` | No | — | Service account password |
+| `MH_LDAP_BASE_DN` | No | — | Base DN for user search (e.g. `dc=example,dc=com`) |
+| `MH_LDAP_USER_FILTER` | No | `(&(objectClass=inetOrgPerson)(uid=%s))` | LDAP search filter (`%s` = username) |
+| `MH_LDAP_SKIP_TLS` | No | `false` | Skip TLS verification (for self-signed certs) |
 
 ## Data Volume