feat(settings): write preferredLanguage to FreeIPA + propagate

- AccountSettings's existing language picker now persists to FreeIPA
  via LDAP modify as svc-gsc-admin (new role 'User Preferred
  Language Manager' granted `write` on `preferredLanguage`).
- Server action also sets NEXT_LOCALE cookie Domain=.gosec.internal
  so admin.gosec.internal / siblings pick up the change before the
  next Keycloak token refresh.
- src/i18n/request.ts updated to read the Keycloak claim
  `preferred_language` (resolution: cookie → claim → header → en).

Other AccountSettings fields are accepted silently for now; they'll
move to FreeIPA / dedicated stores in the Phase 2 cleanup. + ldapts
dep for the LDAP client.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -18,6 +18,7 @@
     "@prisma/client": "^6.1.0",
     "bootstrap": "^5.3.3",
     "clsx": "^2.1.0",
+    "ldapts": "^8.0.36",
     "next": "^16.1.1",
     "next-auth": "^5.0.0-beta.25",
     "next-intl": "^4.6.1",