feat: LDAP 账号管理 — OU管理/添加用户/删除用户/批量导入

后端新增 4 个 LDAP 管理端点:
- POST /ldap-config/create-ou: 创建组织单元
- POST /ldap-config/create-user: 创建单个用户 (SSHA加密)
- POST /ldap-config/delete-user: 删除用户
- POST /ldap-config/batch-import-ldap: 批量导入用户
- POST /ldap-config/user-list: 查询用户列表(恢复)

前端 LdapConfigPage 增强:
- LDAP 账号管理折叠区(配置存在即显示)
- OU 下拉选择 + 根节点选项 + 数量统计
- 用户列表表格(全选/单选/DN显示)
- 新建 OU 弹框(名称+父级DN+描述)
- 添加用户弹框(用户名+密码+显示名+邮箱+目标OU)
- 删除选中用户按钮(确认后批量删除)

前端 UsersPage BatchImportModal 三 Tab:
- 本地导入 / 导入到 LDAP / 从 LDAP 导入

测试修复:
- test_user_endpoint.py: 分页格式兼容
- test_users.py: 分页格式兼容
- test_system_settings.py: 精简后配置项匹配

backend/tests/test_system_settings.py

@@ -42,9 +42,8 @@ async def test_get_settings(client, admin_token):
     data = resp.json()
     assert "query" in data
     assert "security" in data
-    assert "ticket" in data
-    # 查询控制至少 7 项
-    assert len(data["query"]) >= 7
+    # 查询控制至少 3 项 (max_limit, timeout, auto_limit)
+    assert len(data["query"]) >= 3
 
 
 @pytest.mark.asyncio
@@ -64,20 +63,20 @@ async def test_update_settings_boolean(client, admin_token):
     """更新布尔设置项。"""
     token = admin_token
     resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[
-        {"key": "query_require_approval", "value": "true"}
+        {"key": "query_auto_limit", "value": "false"}
     ])
     assert resp.status_code == 200
-    assert "query_require_approval" in resp.json()["updated"]
+    assert "query_auto_limit" in resp.json()["updated"]
 
     # 验证
     resp = await client.get("/api/v1/settings", headers=auth_header(token))
     items = resp.json()["query"]
-    approval = next(i for i in items if i["key"] == "query_require_approval")
-    assert approval["value"] == "true"
+    auto_limit = next(i for i in items if i["key"] == "query_auto_limit")
+    assert auto_limit["value"] == "false"
 
     # 恢复
     await client.put("/api/v1/settings", headers=auth_header(token), json=[
-        {"key": "query_require_approval", "value": "false"}
+        {"key": "query_auto_limit", "value": "true"}
     ])
 
 
@@ -103,17 +102,17 @@ async def test_update_settings_validation(client, admin_token):
 
     # 布尔值错误
     resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[
-        {"key": "query_require_approval", "value": "yes"}
+        {"key": "query_auto_limit", "value": "yes"}
     ])
     assert resp.status_code == 400
 
-    # 整数范围错误
+    # 整数范围错误 (query_max_limit min=100)
     resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[
         {"key": "query_max_limit", "value": "10"}
     ])
     assert resp.status_code == 400
 
-    # 超时范围错误
+    # 超时范围错误 (query_timeout min=5)
     resp = await client.put("/api/v1/settings", headers=auth_header(token), json=[
         {"key": "query_timeout", "value": "1"}
     ])
@@ -128,10 +127,8 @@ async def test_public_query_settings(client):
     resp = await client.get("/api/v1/settings/public/query")
     assert resp.status_code == 200
     data = resp.json()
-    assert "query_require_approval" in data
     assert "query_max_limit" in data
     assert "query_timeout" in data
-    assert isinstance(data["query_require_approval"], bool)
     assert isinstance(data["query_max_limit"], int)
 
 
@@ -226,6 +223,6 @@ async def test_settings_auto_seed(client, admin_token):
     resp = await client.get("/api/v1/settings", headers=auth_header(token))
     assert resp.status_code == 200
     data = resp.json()
-    # 确认至少 12 个设置项
+    # 确认至少 9 个设置项 (query:3 + security:2 + cleanup:3 + executor:1)
     total = sum(len(v) for v in data.values())
-    assert total >= 12
+    assert total >= 9