Stop rejecting long AD passphrases before the LDAP bind

[Sev7eNup]

The 72-byte password gate at the top of Login() is BCrypt's truncation limit, but it ran before TryLdapLoginAsync. An AD account with a passphrase longer than ~72 ASCII characters received a generic 401 with the audit reason invalid_password_length and never reached the directory — and a ~12-word passphrase is exactly what the security-conscious orgs deploying LDAP SSO hand out. AD itself permits up to 256 characters, and a directory password never touches BCrypt.

Change

• New MaxDirectoryPasswordBytes = 256 bounds the login payload at the entrance. The anonymous-endpoint amplifier stays closed; [RequestSizeLimit(8 KiB)] on the endpoint already carried most of that weight anyway.
• The BCrypt-specific 72-byte reject moves to the local branch, placed ahead of the lockout reservation so an unauthenticatable length still costs no throttle budget and still audits as invalid_password_length.
• The bootstrap path is untouched: it already runs ValidatePasswordPolicy, which caps at the same 72 bytes and returns the descriptive 400 instead of a bare 401.
• The M-32 comment no longer claims the "every password-setting path runs ValidatePasswordPolicy" premise holds for LDAP — it only ever held for local accounts.

Tests

tests/NodePilot.Api.Tests/Controllers/AuthControllerLdapTests.cs:

• OverlongPassword_IsRejectedBeforeLdapOrThrottleWork now pins the short-circuit at the directory maximum.
• LongPassphrase_PastBcryptsLimit_StillReachesTheLdapBind — a 100-byte passphrase reaches the bind and arrives unshortened (FakeLdapConnectionAdapter gained LastPassword).
• OverlongPassword_AgainstLocalAccount_IsStillRejectedWithoutSpendingLockoutBudget — the local half still rejects, audits invalid_password_length, and leaves FailedLoginCount at 0.

Run: dotnet test tests/NodePilot.Api.Tests --filter "FullyQualifiedName~AuthControllerLdapTests" → 21 passed.

Docs updated in step: docs/ldap-windows-sso.md (security invariants) and the docs-site security overview.

Closes #182