feat: trigger LDAP background sync on successful login

tests/test_auth_router.py

@@ -71,3 +71,29 @@ def test_logout_clears_cookie_and_redirects_to_landing(client, alice):
     assert response.status_code in (302, 303, 307)
     assert response.headers["location"] == "/"
     assert response.cookies.get("access_token", "") == ""
+
+
+from unittest.mock import patch as mock_patch
+
+
+def test_ldap_login_sets_cookie_and_redirects(client, override_db):
+    """LDAP login via mocked ldap_authenticate: cookie is set, redirects to /."""
+    ldap_attrs = {
+        "username": "ldapuser",
+        "full_name": "LDAP User",
+        "department": "EFI",
+        "role": "ST",
+        "account_expires": None,
+    }
+    with mock_patch("app.modules.auth.ldap.ldap_authenticate", return_value=ldap_attrs), \
+         mock_patch("app.modules.auth.ldap.sync_all_users"), \
+         mock_patch("app.modules.auth.router.settings") as mock_settings:
+        mock_settings.LDAP_ENABLED = True
+        mock_settings.LDAP_SERVER = "test"
+        mock_settings.LDAP_DOMAIN = "ADS1"
+        mock_settings.LDAP_SEARCH_BASE = "OU=test"
+        mock_settings.LDAP_SYNC_MIN_INTERVAL_HOURS = 12
+        mock_settings.LDAP_SYNC_LETTER_DELAY_SECONDS = 0.0
+        response = client.post("/auth/login", data={"username": "ldapuser", "password": "any"})
+    assert response.status_code in (302, 303, 307)
+    assert "access_token" in response.cookies