Release 1.2.0: adopt shared @simpleworkjs/* packages; fix directory envelope drift

Rewire onto the shared @simpleworkjs/oidc-client, /directory-schema, /ldap, and
/app-stack packages (deleting the byte-identical local forks). utils/access.js
now fetches reachable hosts through the shared directory client, which
validates the {results} envelope and treats envelope drift as a failed group
rather than silently returning []. models/user_ldap.js is a thin wrapper over
createLdapClient (loose TLS default preserved). build_info moves to utils/ with
the shared {buildVersion,buildHash,buildYear} shape. Align ldapts ^8.1.8 and
redis ^6.1.0. Lockfile regenerated from the registry (no file:/link:).

Co-Authored-By: Claude <noreply@anthropic.com>

nodejs/test/unit/access.test.js

@@ -53,3 +53,17 @@ test('caches per uid', async () => {
 	await accessibleHosts(user, { fetchImpl, ldap });
 	assert.strictEqual(calls, 1);
 });
+
+test('a bare-array response (envelope drift) is treated as a failed group, not silently []', async () => {
+	clearCache();
+	const user = { uid: 'dave', dn: 'd' };
+	// drift shape: a bare array instead of { results: [...] }. The shared client
+	// throws DirectoryEnvelopeViolation; access.js must catch + continue, so a
+	// good group alongside still yields its hosts.
+	const fetchImpl = async (url) => {
+		if (url.includes('drift')) return { ok: true, json: async () => [{ id: '7', kind: 'host' }] };
+		return { ok: true, json: async () => ({ results: [{ id: '8', kind: 'host' }] }) };
+	};
+	const hosts = await accessibleHosts(user, { fetchImpl, ldap: stubLdap(['drift_access', 'good_access']) });
+	assert.deepStrictEqual(hosts.map((h) => h.id), ['8']);
+});