fix: LDAP 测试连接 3s 超时 + 账号验证 search filter %s 替换 + LDAP 登录 fallback

- dialLDAP 辅助函数: 3s timeout 替代无超时 DialURL
- TestLDAPConnection: search_filter (uid=%s) 中 %s 未替换导致搜索失败
- tryLDAPAuth: 同样的 %s 替换 + timeout 3s
- auth.go 登录: 本地密码失败 → LDAP fallback → ldapInfo 判断修复
- BatchImportLDAP: 实现 LDAP 用户批量导入到本地 DB
- 前端 LdapConfigPage: LDAP 测试请求独立 10s timeout
- workflow.go: ResetUserPassword 实现

frontend/src/pages/LdapConfigPage.tsx

@@ -136,7 +136,7 @@ export default function LdapConfigPage() {
       const res = await api.post('/ldap-config/test', {
         test_user: config.admin_dn,
         test_password: config.admin_password || '__use_stored__',
-      }) as any;
+      }, { timeout: 10000 }) as any;
       const data = res?.data ?? res;
       setTestResult({ ok: true, msg: data?.message || 'LDAP 服务器连接成功' });
       setServerConnected(true);
@@ -175,7 +175,7 @@ export default function LdapConfigPage() {
       const res = await api.post('/ldap-config/test', {
         test_user: testUser,
         test_password: testPass,
-      }) as any;
+      }, { timeout: 10000 }) as any;
       const data = res?.data ?? res;
       if (data?.success === false) {
         setAccountResult({ ok: false, msg: data?.message || '验证失败' });