feat: enhance LDAP integration with new configuration options and browsing capabilities

backend/internal/graph/schema.graphql

@@ -31,14 +31,20 @@ type Query {
 
   # List images next to a document.
   images(slug: String!): [ImageFile!]!
+
+  # Browse LDAP tree (admin only)
+  ldapBrowse(url: String, adminUser: String, adminPass: String): LDAPTree!
+
+  # Fetch permissions for a path
+  acl(path: String!): [ACLEntry!]!
 }
 
 type Mutation {
   # First-run setup.
   setup(input: SetupInput!): Boolean!
 
-  # Test an LDAP configuration before saving.
-  testLdapConnection(input: LDAPInput!): LDAPTestResult!
+  # Test an LDAP configuration.
+  testLdapConnection(url: String!, adminUser: String, adminPass: String): LDAPTestResult!
 
   # Authenticate and receive a bearer token.
   login(username: String!, password: String!): String!
@@ -55,6 +61,13 @@ type Mutation {
   # Modify LDAP Configuration (admin only).
   updateLdapConfig(input: LDAPInput): Boolean!
 
+  # Sync users/groups from LDAP
+  importLdapSubject(type: String!, name: String!): Boolean!
+
+  # ACL Mutations
+  setAcl(input: ACLInput!): Boolean!
+  removeAcl(id: Int!): Boolean!
+
   # Modify Storage Path (admin only).
   updateStoragePath(path: String!): Boolean!
 
@@ -87,10 +100,27 @@ type AppConfig {
 }
 
 type LDAPConfig {
-  host:   String!
-  port:   Int!
-  baseDN: String!
-  bindDN: String!
+  url:       String!
+  adminUser: String!
+}
+
+type LDAPTree {
+  users:  [String!]!
+  groups: [String!]!
+}
+
+type ACLEntry {
+  id:         Int!
+  path:       String!
+  subjectType: String!
+  subjectId:  Int!
+  canSearch:  Boolean!
+  canView:    Boolean!
+  canRead:    Boolean!
+  canEdit:    Boolean!
+  canCreate:  Boolean!
+  canDelete:  Boolean!
+  canMove:    Boolean!
 }
 
 type ServerDirectory {
@@ -148,11 +178,22 @@ input SetupInput {
 }
 
 input LDAPInput {
-  host:         String!
-  port:         Int!
-  baseDN:       String!
-  bindDN:       String!
-  bindPassword: String!
+  url:       String!
+  adminUser: String!
+  adminPass: String!
+}
+
+input ACLInput {
+  path:       String!
+  subjectType: String!
+  subjectId:  Int!
+  canSearch:  Boolean!
+  canView:    Boolean!
+  canRead:    Boolean!
+  canEdit:    Boolean!
+  canCreate:  Boolean!
+  canDelete:  Boolean!
+  canMove:    Boolean!
 }
 
 input SaveDocumentInput {