Add account management and LDAP login

Admins can now create local agent/admin accounts and configure LDAP
directly from the UI (Настройки → Аккаунты / LDAP), with login trying
LDAP first and falling back to the local password. This is the first
place users.role is actually enforced (requireAdminSession).

Fixed a bug in the generated 0005 migration: the INSERT into __new_users
selected auth_source from the old users table, which doesn't have that
column yet — caused drizzle-kit migrate to fail silently.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QcXH24ky6zjk2UyK5oZUPH

package.json

@@ -19,6 +19,7 @@
     "drizzle-orm": "^0.45.2",
     "framer-motion": "^12.4.7",
     "imapflow": "^1.5.0",
+    "ldapjs": "^3.0.7",
     "lucide-react": "^0.545.0",
     "mailparser": "^3.9.14",
     "next": "16.2.12",
@@ -31,6 +32,7 @@
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.16",
     "@types/better-sqlite3": "^7.6.13",
+    "@types/ldapjs": "^3.0.6",
     "@types/mailparser": "^3.4.6",
     "@types/node": "^20",
     "@types/nodemailer": "^8.0.1",