LDAP M3: group-to-role mappings and LDAP password flows

## Context

M3 maps directory groups to Kalendee roles and quotas and fixes password flows for directory accounts. Group membership is synced on each login using `groupMappings`, with `defaultQuotaGroup` as the fallback; admins can be granted from mapped directory groups. Password change/reset for directory-backed users must fail with a clear 409 instead of silently diverging from the directory.

## Tasks

- [ ] `auth.ldap.groupMappings` (directory group DN/CN → Kalendee role/group) + `defaultQuotaGroup`
- [ ] Sync group membership on login: add/remove mapped memberships, never touch local-only groups
- [ ] Grant/revoke instance-admin from mapped directory groups
- [ ] Apply quota groups from mappings; document precedence
- [ ] Password change and admin password reset return HTTP 409 with a clear message for directory accounts
- [ ] Tests: mapping parse/validation, add/remove sync, admin promotion/demotion, 409 responses, fallback quota group
- [ ] Docs for directory admins (`application.conf.example`, `DEVELOPING.md`)

## References

- #9 (LDAP M1), #10 (LDAP M2)
- `server/src/main/kotlin/dev/kolektiv/kalendee/groups/` — `GroupService`, quota groups
- `server/src/main/kotlin/dev/kolektiv/kalendee/auth/AuthService.kt`
- `server/src/main/kotlin/dev/kolektiv/kalendee/web/AdminActions.kt`
- `application.conf.example`

## Dependencies

- **Depends on #9 and #10** (configuration + seam, provisioning + identity table).
- No dependency on `feat/oauth-foundation`, though admin/password patterns should stay consistent with OAuth-managed accounts.