Fix uid/gidNumber allocation crash, add a configurable id floor (#44)

Reported: creating any user via the API failed with

  {"name":"InvalidSyntaxError","message":"gidNumber: value #0 invalid per syntax Code: 0x15"}

Root cause: addPosixGroup() computes the next gidNumber as
`Math.max(...groups.map(i => i.gidNumber)) + 1`. theta-env's
bootstrap.js creates the first admin via raw ldapadd with a hardcoded
uidNumber/gidNumber (10000) directly on the user entry, but never
creates a matching posixGroup entry -- so on a theta-env-bootstrapped
directory there are zero posixGroup entries, `Math.max()` on an empty
array is `-Infinity` in JS (not 0), and `-Infinity + 1` stringifies to
"-Infinity" -- an invalid LDAP integer, rejected by the directory. This
broke every single user creation, not just this one.

Separately: the reporter's intended scheme is for organically-created
users to start at uidNumber/gidNumber 1500, distinct from the
bootstrap admin's reserved 10000. Fixing the crash with a bare "floor
of 1500" alone wouldn't achieve that, since addPosixAccount's own
Math.max() would still find the admin's posixAccount entry (uidNumber
10000, found via a different, correctly-indexed search) and allocate
10001 for the next user.

Added a shared nextPosixId(entries, key) helper: takes the highest
existing value strictly below conf.ldap.uidGidReservedFloor (default
9000) plus one, or conf.ldap.uidGidMin (default 1500) if there are no
such entries. Ids at/above the reserved floor -- like the bootstrap
admin's 10000 -- are ignored entirely when computing the next
available number, so real users always start at 1500 and grow upward
regardless of the admin's reserved id.

Verified against a real theta-env deployment end to end:
- Reproduced the exact reported crash on a fresh bootstrap
- After the fix: first real user gets uidNumber/gidNumber "1500",
  second gets "1501" -- admin's 10000 never enters the calculation
- New unit tests (nodejs/tests/posix_id.test.js, no LDAP required):
  6/6 pass, covering the empty-array case, the reserved-floor
  exclusion, and the NaN-from-missing-value case
- npm test: 18/18 passing tests still pass (unchanged); the other 155
  failures are pre-existing/environmental (no LDAP server in this
  sandbox) -- confirmed via git stash before starting this fix

nodejs/models/user_ldap.js

@@ -45,6 +45,23 @@ function escapeLDAPSearchValue(val) {
               .replace(/\0/g, '\\00');
 }
 
+// Compute the next available uid/gidNumber: the highest existing value below
+// conf.uidGidReservedFloor, plus one -- or conf.uidGidMin if there are no
+// such entries yet. Entries at/above the reserved floor (e.g. a bootstrap
+// admin deliberately given a high, easily-recognizable id -- see
+// theta-env's bootstrap.js) are ignored, so they don't drag every real
+// user's id up into that same range. Math.max() on an empty array is
+// -Infinity in JS, not 0 -- without the explicit floor here, a fresh
+// directory with zero existing entries produces an invalid ("-Infinity")
+// LDAP attribute value and the add fails with InvalidSyntaxError.
+function nextPosixId(entries, key){
+	const existing = entries
+		.map(i => Number(i[key]))
+		.filter(n => Number.isFinite(n) && n < conf.uidGidReservedFloor);
+
+	return String(Math.max(conf.uidGidMin - 1, ...existing) + 1);
+}
+
 async function addPosixGroup(client, data){
 
   try{
@@ -53,7 +70,7 @@ async function addPosixGroup(client, data){
 	  filter: '(&(objectClass=posixGroup))',
 	})).searchEntries;
 
-	data.gidNumber = (Math.max(...groups.map(i => i.gidNumber))+1)+'';
+	data.gidNumber = nextPosixId(groups, 'gidNumber');
 
 	await client.add(`cn=${data.cn},${conf.groupBase}`, {
 	  cn: data.cn,
@@ -75,7 +92,7 @@ async function addPosixAccount(client, data){
 		filter: conf.userFilter,
 	})).searchEntries;
 
-	data.uidNumber = (Math.max(...people.map(i => i.uidNumber))+1)+'';
+	data.uidNumber = nextPosixId(people, 'uidNumber');
 
 	const entry = {
 		cn: data.cn,
@@ -742,7 +759,7 @@ User.login = async function(data){
 };
 
 
-module.exports = {User, hashPasswordSSHA512};
+module.exports = {User, hashPasswordSSHA512, nextPosixId};
 
 
 // (async function(){