Dashboard: list hosts you can reach; bump @simpleworkjs/ldap to 1.0.1

- New GET /api/user/hosts (auth-only): all hosts for admins, group-filtered
  list for everyone else.
- accessibleHosts() accepts a pre-resolved user.groups, so the web UI's
  OIDC session skips a redundant LDAP getGroups(dn) call.
- Dashboard shows a "Hosts you can reach" / "All hosts" table.
- @simpleworkjs/ldap 1.0.1 fixes addSshKey's ObjectClassViolationError on
  accounts predating the ldapPublicKey objectClass -- was aborting key
  injection (and the SSH connection) on affected accounts.
- Bump to 1.5.0.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {
@@ -20,10 +20,10 @@
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^7.3.0",
-    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/app-stack": "^1.0.0",
-    "@simpleworkjs/ldap": "^1.0.0",
+    "@simpleworkjs/conf": "^1.2.0",
     "@simpleworkjs/directory-schema": "^1.0.0",
+    "@simpleworkjs/ldap": "^1.0.1",
     "@simpleworkjs/oidc-client": "^1.0.0",
     "@simpleworkjs/orm": "^0.2.8",
     "bcrypt": "^6.0.0",