Add Unix/POSIX service accounts, distinct from LDAP bind-only ones

The Integrations page's Service Accounts (bind-only, organizationalRole)
don't cover the other real use case: an account something actually runs
as on a Linux host -- a media manager, a torrent client, Emby -- with a
real uidNumber/gidNumber that owns files, and a group other accounts
join for write access (e.g. a `stuff_manager` group granting write
rights to a media library). That needs a real posixAccount, which the
bind-only model can't be.

- New well-known group `app_sso_service_account`, seeded the same way as
  app_sso_admin/app_sso_invite/app_sso_oauth_admin (docker-entrypoint.sh,
  ops/ldap-setup.sh). Not a permission gate -- a marker.
- "Add new user" form gets a "This is a service account" checkbox: swaps
  the person-shaped fields (first/last name, birthday, ToS agreement)
  for a single account-name field, since none of those make sense for a
  non-person account. On create, the route adds the user to
  app_sso_service_account.
- User.listDetail() annotates each user with isServiceAccount (checked
  against the marker group's member list once per call, not the memberof
  overlay's reverse attribute -- not reliably returned by every LDAP
  server this app might point at, confirmed against a real external
  directory during testing). Users page shows a "service" badge.
- Notification broadcasts (filter_type=all/all_active) exclude service
  accounts by default -- nobody reads mail as `stuff_manager`.
- Fixed a real, previously-unrelated bug this surfaced: addPosixAccount
  unconditionally set `mail: data.mail` in the LDAP entry even when
  undefined, and ldapts/slapd reject an attribute given an explicit
  undefined value ("no values for attribute type") rather than treating
  it as absent. This meant creating ANY user without an email already
  failed outright -- not something a service account (which commonly has
  no real mailbox) could route around. Made mail conditional, matching
  how mobile/sshPublicKey/dob already work.
- docs/ldap.md now explains both kinds of service account side by side
  and when to use which.

Verified end-to-end against a real external LDAP server (not a local
sandbox): created a service account with no email, confirmed it's
correctly flagged and excluded from broadcast recipient resolution,
confirmed a normal user is unaffected, confirmed the code degrades
gracefully if the marker group doesn't exist yet (pre-upgrade
deployments).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/models/user_ldap.js

@@ -101,7 +101,6 @@ async function addPosixAccount(client, data){
 		uidNumber: data.uidNumber,
 		gidNumber: data.gidNumber,
 		givenName: data.givenName,
-		mail: data.mail,
 		loginShell: data.loginShell,
 		homeDirectory: data.homeDirectory,
 		userPassword: data.userPassword,
@@ -112,6 +111,14 @@ async function addPosixAccount(client, data){
 		objectclass: ['inetOrgPerson', 'sudoRole', 'ldapPublicKey', 'posixAccount', 'top', 'theta42Person'],
 	};
 
+	// mail is optional in the inetOrgPerson schema, but ldapts/slapd reject an
+	// attribute given an explicit undefined value ("no values for attribute
+	// type") rather than just omitting it -- service accounts (a Unix account
+	// an app/service runs as) commonly have no real mailbox.
+	if (data.mail) {
+		entry.mail = data.mail;
+	}
+
 	if (data.mobile) {
 		entry.mobile = data.mobile;
 	}
@@ -225,6 +232,16 @@ User.listDetail = async function(){
 			return res.searchEntries;
 		});
 
+		// Members of app_sso_service_account are non-person accounts (media
+		// managers, app service users, ...) -- fetched once here rather than
+		// relying on the memberof overlay's reverse attribute, which isn't
+		// reliably returned by every LDAP server this app might point at.
+		let serviceAccountDNs = new Set();
+		try{
+			const svcGroup = await Group.get('app_sso_service_account');
+			serviceAccountDNs = new Set((svcGroup.member || []).map(dn => dn.toLowerCase()));
+		}catch(error){ /* group not seeded yet on an old deployment -- treat as none */ }
+
 		const users = await Promise.all(searchEntries.map(async (entry) => {
 			const rawPassword = entry.userPassword ? entry.userPassword.toString() : '';
 			const isLegacyMD5 = rawPassword.toUpperCase().startsWith('{MD5}');
@@ -251,6 +268,7 @@ User.listDetail = async function(){
 				passwordMustChange  && 'password',
 			].filter(Boolean);
 			obj.onboardingRequired = obj.onboardingNeeds.length > 0 ? 'yes' : '';
+			obj.isServiceAccount   = serviceAccountDNs.has(String(obj.dn).toLowerCase()) ? 'yes' : '';
 
 			return obj;
 		}));