fix(ldap): add Close() method and defer conn.Close() at all call sites

LDAP connections were never closed, leaking TCP connections on every
request. Also refactors change.go from chained else-if to early returns
for cleaner defer placement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

main.go

@@ -207,6 +207,7 @@ func main() {
 			if err != nil || conn == nil {
 				log.Fatalf("Unable to connect to LDAP: %s", err.Error())
 			}
+			defer conn.Close()
 
 			token, dn, err := lostPasswordToken(conn, login)
 			if err != nil {