df6fca815a
- AccountSettings's existing language picker now persists to FreeIPA via LDAP modify as svc-gsc-admin (new role 'User Preferred Language Manager' granted `write` on `preferredLanguage`). - Server action also sets NEXT_LOCALE cookie Domain=.gosec.internal so admin.gosec.internal / siblings pick up the change before the next Keycloak token refresh. - src/i18n/request.ts updated to read the Keycloak claim `preferred_language` (resolution: cookie → claim → header → en). Other AccountSettings fields are accepted silently for now; they'll move to FreeIPA / dedicated stores in the Phase 2 cleanup. + ldapts dep for the LDAP client. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>