feat: LDAP avatar support via lldap

- Create tinker-tickets service account in lldap (lldap_strict_readonly)
- Add /api/user_avatar.php: binds to lldap, fetches avatar attribute,
  caches JPEG to uploads/avatars/, returns 404 sentinel for missing photos
- Install php8.2-ldap on LXC 132 (beta) and LXC coding server
- Update layout_header.php: show lt-avatar with photo overlay + initials fallback
- Update TicketView.php: comment avatars use photo overlay pattern
- Add .lt-avatar-img / .lt-avatar-initials CSS for photo-over-initials layout
- Add LDAP_* config keys to config.php and .env.example

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

views/layout_header.php

@@ -151,7 +151,24 @@ $_lt_navActive = $activeNav ?? 'dashboard';
 
     <div class="lt-header-right">
 <?php if (!empty($_lt_user)): ?>
-      <span class="lt-header-user"><?= htmlspecialchars($_lt_user['display_name'] ?? $_lt_user['username'] ?? '', ENT_QUOTES, 'UTF-8') ?></span>
+      <?php
+        $_lt_displayName = $_lt_user['display_name'] ?? $_lt_user['username'] ?? '';
+        $_lt_words    = array_filter(explode(' ', $_lt_displayName));
+        $_lt_initials = strtoupper(implode('', array_map(fn($w) => $w[0], array_slice($_lt_words, 0, 2))));
+        $_lt_userId   = (int)($_lt_user['user_id'] ?? 0);
+        $_lt_avatarColors = ['lt-avatar--orange', 'lt-avatar--green', 'lt-avatar--purple', ''];
+        $_lt_avatarColor  = $_lt_avatarColors[abs(crc32($_lt_displayName)) % count($_lt_avatarColors)];
+      ?>
+      <div class="lt-avatar lt-avatar--sm <?= $_lt_avatarColor ?>" aria-hidden="true" title="<?= htmlspecialchars($_lt_displayName, ENT_QUOTES, 'UTF-8') ?>">
+        <?php if ($_lt_userId > 0): ?>
+          <img src="/api/user_avatar.php?user_id=<?= $_lt_userId ?>"
+               alt=""
+               class="lt-avatar-img"
+               onerror="this.style.display='none'">
+        <?php endif ?>
+        <span class="lt-avatar-initials"><?= htmlspecialchars($_lt_initials) ?></span>
+      </div>
+      <span class="lt-header-user"><?= htmlspecialchars($_lt_displayName, ENT_QUOTES, 'UTF-8') ?></span>
 <?php   if ($_lt_isAdmin): ?>
       <span class="lt-badge lt-badge-admin" aria-label="Administrator">ADMIN</span>
 <?php   endif; ?>