LDAP/AD-Auth fuer Dashboard: User-Bind gegen insight.local, Zugriff nur fuer Domänen-Admins

- ldap_auth Service: User bindet als user@domain (kein Servicekonto noetig),
  Gruppenpruefung ueber Matching-Rule-In-Chain (verschachtelte Gruppen)
- Login-Route: lokaler User zuerst, dann LDAP-Fallback; LDAP-User werden
  lokal gespiegelt (is_ldap, is_admin, Profildaten aus AD)
- Neue Config: ldap_domain, ldap_admin_group, ldap_timeout_seconds
- ldap3 Dependency, 7 Unit-Tests (ldap3 gemockt), ruff+mypy sauber
- Gruppen-DN verified am DC: CN=Domänen-Admins,CN=Users,DC=insight,DC=local

backend/app/core/config.py

@@ -35,13 +35,14 @@ class Settings(BaseSettings):
     # seconds is considered stale and marked failed by the janitor
     job_stale_timeout: int = 3600
 
-    # LDAP (stub)
+    # LDAP / Active Directory (user bind, no service account)
     ldap_enabled: bool = False
     ldap_uri: str = ""
-    ldap_bind_dn: str = ""
-    ldap_bind_password: str = ""
+    ldap_domain: str = ""  # bind as user@domain; empty = plain username bind
     ldap_user_search_base: str = ""
     ldap_user_filter: str = "(sAMAccountName={username})"
+    ldap_admin_group: str = ""  # DN, e.g. CN=Admins,CN=Users,DC=example,DC=com
+    ldap_timeout_seconds: int = 10
 
     # CORS
     cors_origins: str = "http://localhost:3000,http://localhost:8000"