fix(ldap): add Close() method and defer conn.Close() at all call sites

LDAP connections were never closed, leaking TCP connections on every
request. Also refactors change.go from chained else-if to early returns
for cleaner defer placement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lost.go

@@ -129,6 +129,7 @@ func lostPassword(w http.ResponseWriter, r *http.Request) {
 		displayTmplError(w, http.StatusInternalServerError, "lost.html", map[string]any{"error": "Unable to process your request. Please try again later."})
 		return
 	}
+	defer conn.Close()
 
 	// Generate the token
 	token, dn, err := lostPasswordToken(conn, r.PostFormValue("login"))