feat: add Windows DNS, LDAP, and Update settings tabs to UI

- Settings page: 3 new tabs (Windows DNS, LDAP / AD, Updates)
- Windows DNS tab: enable toggle, server/zone/username/password/record-IP,
  save + test connection button
- LDAP tab: enable toggle, server/port/SSL/bind-DN/password/base-DN/
  user-filter/group-DN, save + test connection button
- Updates tab: current + latest version info card with update-available
  badge, one-click update button (git pull + rebuild), git repo/branch/
  token settings form
- Azure AD tab: added Allowed Group Object ID field
- app.js: settings-dns-form, settings-ldap-form, settings-git-form
  submit handlers; testDnsConnection(), testLdapConnection(),
  loadVersionInfo(), triggerUpdate() functions; loadSettings() extended
  for all new fields
- en.json: all new translation keys
- de.json: complete German translation (was mostly empty before)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

static/lang/en.json

@@ -120,6 +120,9 @@
     "tabBranding": "Branding",
     "tabUsers": "Users",
     "tabAzure": "Azure AD",
+    "tabDns": "Windows DNS",
+    "tabLdap": "LDAP / AD",
+    "tabUpdate": "Updates",
     "tabSecurity": "Security",
     "baseDomain": "Base Domain",
     "baseDomainPlaceholder": "yourdomain.com",
@@ -202,6 +205,52 @@
     "secretSet": "Secret is set (leave empty to keep current)",
     "noSecret": "No client secret configured",
     "saveAzureSettings": "Save Azure AD Settings",
+    "azureGroupId": "Allowed Group Object ID (optional)",
+    "azureGroupIdHint": "If set, only Azure AD members of this group can log in.",
+    "dnsTitle": "Windows DNS Integration",
+    "enableDns": "Enable Windows DNS Integration",
+    "dnsDescription": "Automatically create/delete DNS A-records when deploying customers.",
+    "dnsServer": "DNS Server Address",
+    "dnsZone": "DNS Zone",
+    "dnsUsername": "Username (NTLM)",
+    "dnsPassword": "Password",
+    "dnsRecordIp": "A-Record Target IP",
+    "dnsRecordIpHint": "IP address that customer A-records will point to (usually your NPM server IP).",
+    "saveDnsSettings": "Save DNS Settings",
+    "ldapTitle": "LDAP / Active Directory Authentication",
+    "enableLdap": "Enable LDAP / AD Authentication",
+    "ldapDescription": "Allow Active Directory users to log in. Local admin accounts always work as fallback.",
+    "ldapServer": "LDAP Server",
+    "ldapPort": "Port",
+    "ldapUseSsl": "Use SSL/TLS (LDAPS)",
+    "ldapBindDn": "Bind DN (Service Account)",
+    "ldapBindPassword": "Bind Password",
+    "ldapBaseDn": "Base DN",
+    "ldapUserFilter": "User Filter",
+    "ldapUserFilterHint": "Use {username} as placeholder for the login name.",
+    "ldapGroupDn": "Group Restriction DN (optional)",
+    "ldapGroupDnHint": "If set, only members of this group can log in via LDAP.",
+    "saveLdapSettings": "Save LDAP Settings",
+    "versionTitle": "Version & Updates",
+    "currentVersion": "Installed Version",
+    "latestVersion": "Latest Available",
+    "branch": "Branch",
+    "updateAvailable": "Update Available",
+    "upToDate": "Up to date",
+    "triggerUpdate": "Start Update",
+    "updateWarning": "The app will be unavailable for ~60 seconds during rebuild.",
+    "confirmUpdate": "Start the update now? The database will be backed up first. The app will restart (~60 seconds downtime).",
+    "gitTitle": "Git Repository Settings",
+    "gitRepoUrl": "Repository URL",
+    "gitRepoUrlHint": "Used for version checks and one-click updates via Gitea API.",
+    "gitBranch": "Branch",
+    "gitToken": "Access Token (optional)",
+    "saveGitSettings": "Save Git Settings",
+    "leaveEmptyToKeep": "Leave empty to keep current",
+    "passwordSet": "Password is set (leave empty to keep current)",
+    "noPasswordSet": "No password configured",
+    "tokenSet": "Token is set (leave empty to keep current)",
+    "noToken": "No access token configured",
     "securityTitle": "Change Admin Password",
     "currentPassword": "Current Password",
     "newPassword": "New Password (min 12 chars)",
@@ -306,6 +355,10 @@
     "logoUploaded": "Logo uploaded successfully.",
     "logoRemoved": "Logo removed.",
     "azureSettingsSaved": "Azure AD settings saved.",
+    "dnsSettingsSaved": "DNS settings saved.",
+    "ldapSettingsSaved": "LDAP settings saved.",
+    "gitSettingsSaved": "Git settings saved.",
+    "updateStarted": "Update started. The app will restart shortly.",
     "passwordChanged": "Password changed successfully.",
     "setupUrlCopied": "Setup URL copied to clipboard.",
     "copiedToClipboard": "Copied to clipboard.",