Adding LDAP support

CLAUDE.md

@@ -44,6 +44,13 @@ token logic in `app/services/auth.py`. Keep route handlers thin; put DB logic in
 - **Auth, two transports**: API uses `Authorization: Bearer`; the HTMX UI uses an
   httpOnly cookie (`settings.cookie_name`). `app/deps.py` reads both. Web auth
   failures raise `NotAuthenticated`, handled in `main.py` as a redirect to `/login`.
+- **Credential verification** goes through `services/auth.authenticate(db, username,
+  password)` — both login routes call it, not `crud.user.authenticate` directly.
+  When `settings.ldap_enabled`, it binds against LDAP first (`services/ldap.py`,
+  sync `ldap3` offloaded via `run_in_threadpool`), provisions/refreshes the local
+  row via `crud.user.upsert_ldap_user` (unusable local password, `auth_provider="ldap"`,
+  `LDAP_DEFAULT_ROLES`), then falls back to local DB auth. LDAP config lives in
+  `settings.ldap_*`. Tests fake the blocking bind by patching `services.ldap._authenticate_sync`.
 - **Refresh tokens** are stored server-side (hash + `jti` + `revoked`) in the
   `refresh_tokens` table. `services/auth.rotate_refresh_token` revokes-then-reissues.
   Note: JWT payload `exp` is a tz-aware `datetime` (PyJWT only epoch-encodes inside