fix: LDAP导入用户 auth_source 修复

- BatchImportLdapUsers: 设置 AuthSource='ldap' + HashedPassword='-' + IsActive=true
- 修正已有 zhangsan/lisi/wangwu 用户 auth_source 从 local 改为 ldap

backend/internal/handler/workflow.go

@@ -282,8 +282,6 @@ func BatchImportLdapUsers(c *gin.Context) {
 
 	successCount := 0
 	var errors []string
-	defaultPassword := "admin123"
-	hash, _ := bcrypt.GenerateFromPassword([]byte(defaultPassword), bcrypt.DefaultCost)
 
 	for _, u := range input.Users {
 		// Derive username: uid > username > cn
@@ -322,12 +320,15 @@ func BatchImportLdapUsers(c *gin.Context) {
 			emailPtr = nil
 		}
 
+		isActive := true
 		user := model.User{
 			Username:       username,
 			DisplayName:    displayName,
 			Email:          emailPtr,
-			HashedPassword: string(hash),
+			HashedPassword: "-", // LDAP users don't need local password
 			Role:           "developer",
+			AuthSource:     "ldap",
+			IsActive:       &isActive,
 		}
 		if err := model.DB.Create(&user).Error; err != nil {
 			errors = append(errors, "fail: "+username+" - "+err.Error())