Sign-in fixes for Entra, reverse proxies, and LDAP

Several sign-in paths are fixed. Microsoft Entra logins no longer fail with an unreachable-provider error: the signed identity token already carries what sign-in needs, so the separate user-info endpoint Microsoft serves from another host is no longer called. Single sign-on now works behind a reverse proxy — the redirect URI is taken from your browser’s address instead of being guessed as the gateway’s internal address, and the provider card warns when users are returned to a different address than the one they arrive at. LDAP directory sign-in works again after a connection-timeout defect that failed the bind before it was attempted.

LDAP is also hardened: an empty or whitespace password is refused before the directory is contacted, usernames are escaped to prevent injection, and a search matching more than one entry is refused instead of picking the first.

No action required.