feat(ldap): Active Directory 双目录支持与 Docker 构建优化

- 新增 ldap_ad.go，支持 AD 密码编码、字段映射与目录类型判断
- 重构 ldap/ldap_users/ldap_ou，兼容 OpenLDAP 与 AD 登录、导入、OU 浏览
- 前端系统设置增加目录类型选择与 AD 配置项
- Dockerfile 按 TARGETARCH 单架构编译 Agent，限制 Node 内存防 OOM
- run.sh 新增 docker fast/upgrade，README 补充 LDAP/AD 与常见问题

backend/controller/ldap_ou.go

@@ -3,7 +3,6 @@ package controller
 import (
 	"fmt"
 	"net/http"
-	"time"
 
 	"ezops/model"
 
@@ -20,48 +19,48 @@ func (h *LDAPHandler) ListLDAPOUs(c *gin.Context) {
 		return
 	}
 	cfg := configs[0]
-	port := 389
-	if cfg.LDAPPort != nil {
-		port = *cfg.LDAPPort
-	}
 
-	conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
+	conn, err := dialLDAP(&cfg)
 	if err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
 		return
 	}
 	defer conn.Close()
-	conn.SetTimeout(5 * time.Second)
 	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
 		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
 		return
 	}
 
-	searchReq := ldap.NewSearchRequest(
-		cfg.BaseDN,
-		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		"(objectClass=organizationalUnit)",
-		[]string{"ou", "description"},
-		nil,
-	)
-	sr, err := conn.Search(searchReq)
-	if err != nil {
-		c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
-		return
-	}
-
 	type OU struct {
 		DN          string `json:"dn"`
 		Name        string `json:"name"`
 		Description string `json:"description"`
 	}
 	var ous []OU
-	for _, e := range sr.Entries {
-		ous = append(ous, OU{
-			DN:          e.DN,
-			Name:        e.GetAttributeValue("ou"),
-			Description: e.GetAttributeValue("description"),
-		})
+	seenDN := map[string]bool{}
+	for _, filter := range ldapOUListFilters(&cfg) {
+		searchReq := ldap.NewSearchRequest(
+			cfg.BaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			filter,
+			[]string{"ou", "cn", "name", "description"},
+			nil,
+		)
+		sr, err := conn.Search(searchReq)
+		if err != nil {
+			continue
+		}
+		for _, e := range sr.Entries {
+			if seenDN[e.DN] {
+				continue
+			}
+			seenDN[e.DN] = true
+			ous = append(ous, OU{
+				DN:          e.DN,
+				Name:        ldapOUEntryName(e),
+				Description: e.GetAttributeValue("description"),
+			})
+		}
 	}
 	c.JSON(http.StatusOK, model.Response{Code: 200, Data: ous})
 }
@@ -85,23 +84,18 @@ func (h *LDAPHandler) CreateLDAPOU(c *gin.Context) {
 		return
 	}
 	cfg := configs[0]
-	port := 389
-	if cfg.LDAPPort != nil {
-		port = *cfg.LDAPPort
-	}
 
 	if req.ParentDN == "" {
 		req.ParentDN = cfg.BaseDN
 	}
 	ouDN := fmt.Sprintf("ou=%s,%s", ldap.EscapeFilter(req.OUName), req.ParentDN)
 
-	conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
+	conn, err := dialLDAP(&cfg)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
 		return
 	}
 	defer conn.Close()
-	conn.SetTimeout(5 * time.Second)
 	if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
 		c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
 		return