Add Unix/POSIX service accounts, distinct from LDAP bind-only ones

The Integrations page's Service Accounts (bind-only, organizationalRole)
don't cover the other real use case: an account something actually runs
as on a Linux host -- a media manager, a torrent client, Emby -- with a
real uidNumber/gidNumber that owns files, and a group other accounts
join for write access (e.g. a `stuff_manager` group granting write
rights to a media library). That needs a real posixAccount, which the
bind-only model can't be.

- New well-known group `app_sso_service_account`, seeded the same way as
  app_sso_admin/app_sso_invite/app_sso_oauth_admin (docker-entrypoint.sh,
  ops/ldap-setup.sh). Not a permission gate -- a marker.
- "Add new user" form gets a "This is a service account" checkbox: swaps
  the person-shaped fields (first/last name, birthday, ToS agreement)
  for a single account-name field, since none of those make sense for a
  non-person account. On create, the route adds the user to
  app_sso_service_account.
- User.listDetail() annotates each user with isServiceAccount (checked
  against the marker group's member list once per call, not the memberof
  overlay's reverse attribute -- not reliably returned by every LDAP
  server this app might point at, confirmed against a real external
  directory during testing). Users page shows a "service" badge.
- Notification broadcasts (filter_type=all/all_active) exclude service
  accounts by default -- nobody reads mail as `stuff_manager`.
- Fixed a real, previously-unrelated bug this surfaced: addPosixAccount
  unconditionally set `mail: data.mail` in the LDAP entry even when
  undefined, and ldapts/slapd reject an attribute given an explicit
  undefined value ("no values for attribute type") rather than treating
  it as absent. This meant creating ANY user without an email already
  failed outright -- not something a service account (which commonly has
  no real mailbox) could route around. Made mail conditional, matching
  how mobile/sshPublicKey/dob already work.
- docs/ldap.md now explains both kinds of service account side by side
  and when to use which.

Verified end-to-end against a real external LDAP server (not a local
sandbox): created a service account with no email, confirmed it's
correctly flagged and excluded from broadcast recipient resolution,
confirmed a normal user is unaffected, confirmed the code degrades
gracefully if the marker group doesn't exist yet (pre-upgrade
deployments).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ldap.md

@@ -55,6 +55,7 @@ The SSO requires three groups (seeded automatically by the entrypoint /
 | `app_sso_admin` | full admin (users, groups, settings) |
 | `app_sso_oauth_admin` | OAuth client management |
 | `app_sso_invite` | invitation management |
+| `app_sso_service_account` | not a permission — marks a `posixAccount` as a non-person service account (see *Service accounts* below) |
 
 ## TLS (LDAPS / StartTLS)
 
@@ -90,17 +91,35 @@ volumes:
 
 The entrypoint leaves existing certs untouched (idempotent).
 
-## Direct-bind service accounts
+## Service accounts
 
-For apps that bind LDAP directly, create a dedicated **service account** under
-`ou=people` (e.g. `cn=ldapclient,ou=people,<base>`) with a strong password —
-**don't reuse the admin DN**. The theta-env bootstrap creates this account
-automatically (`cn=ldapclient`) and the proxy binds as it. For anything else,
-create a normal user via the Users page (or `POST /api/user`) and just don't
-put it in `app_sso_admin` or any other privileged group — a plain
-`posixAccount` with a strong password is all a read-only bind account needs.
+There are two different kinds of "not a real person" account, and which one
+you want depends on what's consuming it:
 
-Example bind test:
+**LDAP bind-only** — for an app that just needs to bind LDAP to look users up
+(its own "LDAP authentication" settings page, or the read-only account
+`theta42/ldap-client` binds as). Not a `posixAccount` — no `uidNumber`, no
+home directory, can't log into this UI. Create one from the
+**Integrations → LDAP** tab's *Service Accounts* section (create, rotate
+password, delete). theta-env's bootstrap creates `cn=ldapclient` this same
+way automatically, and the proxy binds as it — don't reuse the admin DN for
+this.
+
+**Unix/POSIX** — for an account something actually *runs as* on a Linux
+host: a media manager, a torrent client, a service like Emby — anything that
+needs a real `uidNumber`/`gidNumber` to own files or that other accounts join
+via a group for write access (e.g. a `stuff_manager` group granting write
+rights to a media library). Create one from the **Users** page's "Add new
+user" form with **This is a service account** checked — it skips the
+birthday/Terms-of-Service fields a real person's account needs and asks for
+just an account name. It's a normal `posixAccount`, just flagged (via
+membership in the `app_sso_service_account` group) so it's visibly marked in
+the Users list and excluded from "all users" notification broadcasts.
+
+Either way: don't reuse the admin DN, and give it only the group memberships
+it actually needs.
+
+Example bind test (LDAP bind-only account):
 
 ```bash
 ldapsearch -x -H ldaps://sso.example.com:636 \