fix: LDAP FetchUsers Filter ohne Klammern erzeugt Compile Error

UserFilter wie 'uid=%s' wurde zu 'uid=*' — kein gültiger LDAP-Filter.
Fix: Klammern ergänzen wenn der Filter nicht mit '(' beginnt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/ldapauth/client.go

@@ -204,8 +204,12 @@ func FetchUsers(cfg Config) ([]LDAPUser, error) {
 	if filter == "" {
 		filter = "(|(objectClass=person)(objectClass=user)(objectClass=inetOrgPerson))"
 	} else {
-		// If the UserFilter is a login filter like (uid=%s), make it a wildcard search.
+		// Convert login filter (e.g. uid=%s or (uid=%s)) to a wildcard search.
 		filter = strings.ReplaceAll(filter, "%s", "*")
+		// Wrap in parentheses if missing — e.g. "uid=*" → "(uid=*)"
+		if !strings.HasPrefix(filter, "(") {
+			filter = "(" + filter + ")"
+		}
 	}
 
 	req := ldapv3.NewSearchRequest(