feat: add Windows DNS integration and LDAP/AD authentication

Windows DNS (WinRM):
- New dns_service.py: create/delete A-records via PowerShell over WinRM (NTLM)
- Idempotent create (removes existing record first), graceful delete
- DNS failures are non-fatal — deployment continues, error logged
- test-dns endpoint: GET /api/settings/test-dns
- Integrated into deploy_customer() and undeploy_customer()

LDAP / Active Directory auth:
- New ldap_service.py: service-account bind + user search + user bind (ldap3)
- Optional AD group restriction via ldap_group_dn
- Login flow: LDAP first → local fallback (prevents admin lockout)
- LDAP users auto-created with auth_provider="ldap" and role="viewer"
- test-ldap endpoint: GET /api/settings/test-ldap
- reset-password/reset-mfa guards extended to block LDAP users

All credentials (dns_password, ldap_bind_password) encrypted with Fernet.
New DB columns added via backwards-compatible migrations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/utils/validators.py

@@ -137,6 +137,23 @@ class SystemConfigUpdate(BaseModel):
         None, max_length=255,
         description="Azure AD group object ID. If set, only members of this group can log in."
     )
+    # Windows DNS
+    dns_enabled: Optional[bool] = None
+    dns_server: Optional[str] = Field(None, max_length=255)
+    dns_username: Optional[str] = Field(None, max_length=255)
+    dns_password: Optional[str] = None  # plaintext, encrypted before storage
+    dns_zone: Optional[str] = Field(None, max_length=255)
+    dns_record_ip: Optional[str] = Field(None, max_length=45)
+    # LDAP
+    ldap_enabled: Optional[bool] = None
+    ldap_server: Optional[str] = Field(None, max_length=255)
+    ldap_port: Optional[int] = Field(None, ge=1, le=65535)
+    ldap_use_ssl: Optional[bool] = None
+    ldap_bind_dn: Optional[str] = Field(None, max_length=500)
+    ldap_bind_password: Optional[str] = None  # plaintext, encrypted before storage
+    ldap_base_dn: Optional[str] = Field(None, max_length=500)
+    ldap_user_filter: Optional[str] = Field(None, max_length=255)
+    ldap_group_dn: Optional[str] = Field(None, max_length=500)
 
     @field_validator("ssl_mode")
     @classmethod