feat: LDAP avatar support via lldap

- Create tinker-tickets service account in lldap (lldap_strict_readonly)
- Add /api/user_avatar.php: binds to lldap, fetches avatar attribute,
  caches JPEG to uploads/avatars/, returns 404 sentinel for missing photos
- Install php8.2-ldap on LXC 132 (beta) and LXC coding server
- Update layout_header.php: show lt-avatar with photo overlay + initials fallback
- Update TicketView.php: comment avatars use photo overlay pattern
- Add .lt-avatar-img / .lt-avatar-initials CSS for photo-over-initials layout
- Add LDAP_* config keys to config.php and .env.example

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

assets/css/base.css

@@ -4522,7 +4522,20 @@ body.lt-is-offline .lt-main { margin-top: 2rem; transition: margin-top 0.25s eas
   flex-shrink: 0;
   user-select: none;
 }
-.lt-avatar img { width: 100%; height: 100%; object-fit: cover; display: block; }
+/* Photo overlay: img sits on top of initials text; hidden via onerror if no photo */
+.lt-avatar { position: relative; }
+.lt-avatar-initials { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; pointer-events: none; }
+.lt-avatar-img {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+  border-radius: inherit;
+  z-index: 1;
+}
+/* Legacy: bare img inside lt-avatar (no .lt-avatar-img class) */
+.lt-avatar > img:not(.lt-avatar-img) { width: 100%; height: 100%; object-fit: cover; display: block; }
 /* Sizes */
 .lt-avatar--xs { width: 1.5rem; height: 1.5rem; font-size: 0.55rem; }
 .lt-avatar--sm { width: 2rem;   height: 2rem;   font-size: 0.65rem; }