feat(auth): add LDAP/AD adapter to the unified identity core

[XiaoSeS]

Parent

• feat(auth): build a unified identity federation architecture #628
• Requirements source: [Feature] 能否支持企业内部的ldap登录 #260
• Community implementation reference: feat(auth): 企业 LDAP 登录与身份绑定 #437
• Depends on the unified identity core, Binding V2, Provider Registry, profile policy, and explicit Identity Link already staged on big-main.

Problem

SkillHub still has no LDAP/AD credential adapter that enters the frozen unified identity boundary. PR #437 authenticates through a local-login fallback and can reuse an existing platform account by email, so it cannot be merged safely.

Scope

Implement PR 7 from docs/21-unified-identity-federation-design.md:

• A dedicated Credential Provider adapter; do not modify local-password semantics.
• Service bind/search, exactly-one match, user-DN bind, and attribute read outside the platform database transaction.
• OpenLDAP entryUUID and Active Directory objectGUID stable subjects.
• Configurable subject and profile attribute mapping; username, DN, and email are not default identity keys.
• Typed subject/alias output through ProviderAuthenticationResult and the shared ExternalIdentityLoginService.
• No email-based implicit link or account takeover; collisions return the shared link-required outcome.
• LDAPS and StartTLS support; no production trust-all escape hatch.
• Escaped search filters, bounded response sizes, explicit connection/read/pool timeouts, and stable safe error codes.
• Disabled or incomplete providers do not initialize a client, make network calls, or appear in /api/v1/auth/methods.
• Default-off Compose, Helm, and Kustomize configuration plus operator documentation.
• Audit, low-cardinality metrics, and secret/log redaction.

Acceptance

• Provider Conformance Kit passes.
• Real OpenLDAP tests cover plain LDAP, LDAPS, StartTLS, first/repeat login, username change, profile policy, email collision, missing entryUUID, multiple results, injection input, invalid password, unavailable directory, and timeouts.
• Fixed AD objectGUID byte-order fixtures pass.
• Existing GitHub/GitLab/OIDC, CAS, local password, Device Flow, API token, link, and account-merge behavior remains compatible.
• Upgrade from the current big-main database/session state is additive and rollback-safe.
• The exact feature commit is merged only to big-main, built into a revision-labelled image, and validated on the Hong Kong test machine without rebooting the host.
• Test resources, images, and caches created by this run are cleaned without touching Multica or existing runtime resources.

Delivery

Target a dedicated PR at big-main. Do not merge to main without explicit maintainer confirmation.

[github-actions]

Issue Triage

• Route: triage/needs-info
• Priority: priority/p1 (3.8/5)
• Effort: effort/m (3/5)
• Confidence: 2/5
• Risk: high
• Analysis Mode: rules-only

Why

• Touches core SkillHub workflows (search, auth, login).
• Contains urgency signals (cannot, production).
• Text suggests a bounded change (docs, documentation, label).

High-Risk Signals

• Mentions sensitive areas (auth).

Next Action

• Wait for more detail, then rerun triage after the author edits the issue or comments /retriage. Missing: .

---

问题分流结果

• 路由: triage/needs-info
• 优先级: priority/p1 (3.8/5)
• 修复投入: effort/m (3/5)
• 信息完整度: 2/5
• 风险: 高
• 分析模式: rules-only

原因

• 涉及 SkillHub 核心流程（search, auth, login）
• 包含紧急信号（cannot, production）
• 文本显示改动范围较可控（docs, documentation, label）

高风险信号

• 提到敏感区域（auth）

下一步

• 等待补充更多信息；作者更新 issue 或评论 /retriage 后重新分流