[tire-fire]

LDAP access was written out three times: team import in engine/db/db.go, login in www/api/authentication.go, and per-request role lookup in www/api/identity.go. Each one dialed, bound as the service account and built its own search request.

This moves that into a small engine/ldapdir package with three calls:

• TeamMembers – sAMAccountNames in the team group (team import)
• Groups – a user's memberOf values (role lookup)
• Authenticate – finds the single matching user, checks the password with a bind, and returns that user's memberOf values (login)

Group-to-role mapping now lives in one place (ldapGroupRoles), used by both login and role lookup, so the two can't drift apart.

Behavior changes:

• Team group DN is now escaped in the team import filter. It was interpolated raw, so a DN containing \, (, ) or * (for example an escaped comma, CN=Blue\, Team,...) produced a broken or wrong filter.
• Login does one search instead of two. It reads memberOf from the same entry it checked the password against, using the service account, which is how role lookup already reads it on every request. Before, login searched again as the user, which could see different group data than later requests.

Tests: added TestLdapGroupRoles. The full suite and golangci-lint pass. There is no LDAP server in the test setup, so the directory calls themselves aren't covered by a test.