- AccountSettings's existing language picker now persists to FreeIPA
via LDAP modify as svc-gsc-admin (new role 'User Preferred
Language Manager' granted `write` on `preferredLanguage`).
- Server action also sets NEXT_LOCALE cookie Domain=.gosec.internal
so admin.gosec.internal / siblings pick up the change before the
next Keycloak token refresh.
- src/i18n/request.ts updated to read the Keycloak claim
`preferred_language` (resolution: cookie → claim → header → en).
Other AccountSettings fields are accepted silently for now; they'll
move to FreeIPA / dedicated stores in the Phase 2 cleanup. + ldapts
dep for the LDAP client.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
df6fca815a