Redesign the LDAP settings page and its group mapping card - #82389

Description

Implements ENG-10893.

Redesigns the LDAP page: reorder cards, defaults shown as placeholders, and a Group mapping card with a live switch and an inline mapping editor.

• LDAP assigns groups through explicit DN mappings only, so the card is a switch plus mappings rather than JWT's three-way control. Both save on their own; the directory fields still save with the page.
• BE: An invalid DN now comes back as a 400 with the reason instead of a 500, and the editor shows it under the field.
• Incidental: JWT now imports the pure mapping helpers from the new OSS module. The rest of the editor stays duplicated until the SAML and OIDC redesigns land.

Demo

https://www.loom.com/share/640fb6ddea4c440d80a29050d3037664