fix(ldap): add Close() method and defer conn.Close() at all call sites

LDAP connections were never closed, leaking TCP connections on every
request. Also refactors change.go from chained else-if to early returns
for cleaner defer placement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ldap.go

@@ -6,6 +6,8 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"strconv"
+	"time"
 
 	"github.com/amoghe/go-crypt"
 	"github.com/go-ldap/ldap/v3"
@@ -58,6 +60,10 @@ type LDAPConn struct {
 	connection *ldap.Conn
 }
 
+func (l LDAPConn) Close() {
+	l.connection.Close()
+}
+
 func (l LDAPConn) ServiceBind() error {
 	return l.connection.Bind(l.ServiceDN, l.ServicePassword)
 }
@@ -133,6 +139,7 @@ func (l LDAPConn) ChangePassword(dn string, rawpassword string) error {
 
 	modify := ldap.NewModifyRequest(dn, nil)
 	modify.Replace("userPassword", []string{"{CRYPT}" + hashedpasswd})
+	modify.Replace("shadowLastChange", []string{strconv.FormatInt(time.Now().Unix()/86400, 10)})
 
 	return l.connection.Modify(modify)
 }