fix(ldap): add Close() method and defer conn.Close() at all call sites

LDAP connections were never closed, leaking TCP connections on every
request. Also refactors change.go from chained else-if to early returns
for cleaner defer placement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

login.go

@@ -78,6 +78,7 @@ func login(login string, password string) ([]*ldap.EntryAttribute, error) {
 	if err != nil || conn == nil {
 		return nil, err
 	}
+	defer conn.Close()
 
 	if err = conn.ServiceBind(); err != nil {
 		return nil, err