feat(auth): LDAP and SSO users keep their source; directory TLS is real (#5036)

#5036 "SSO and LDAP: users keep their auth source, no merging into local
accounts, is_active checked, LDAP TLS real and filter escaped".

- users gain auth_source (local/ldap/oidc) and external_id (migration 0027).
  A provider account is found by (source, subject) only: the LDAP entry DN
  or the OIDC sub. A first sign-in whose username or email another account
  holds is refused with a message naming why; a disabled user stays out.
- Local passwords sign in local accounts only.
- LDAP: port 636 is LDAPS, otherwise StartTLS before any bind; the server
  certificate is checked against the system CAs or a CA pasted in
  Settings -> Auth. The login name is escaped into the filter (RFC 4515),
  and an empty password is refused before the directory sees it.
- OIDC: the ID token must carry this sign-in's nonce and the userinfo sub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/settings/routes.py

@@ -466,6 +466,7 @@ async def save_auth_settings():
             await set_setting(db, "ldap.host", form.get("ldap.host", "").strip())
             await set_setting(db, "ldap.port", int(form.get("ldap.port") or 389))
             await set_setting(db, "ldap.tls", "ldap.tls" in form)
+            await set_setting(db, "ldap.ca_cert", form.get("ldap.ca_cert", "").strip())
             await set_setting(db, "ldap.bind_dn", form.get("ldap.bind_dn", "").strip())
             if form.get("ldap.bind_password"):
                 await set_setting(db, "ldap.bind_password", form.get("ldap.bind_password").strip())