fix(ldap): add Close() method and defer conn.Close() at all call sites

LDAP connections were never closed, leaking TCP connections on every
request. Also refactors change.go from chained else-if to early returns
for cleaner defer placement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

reset.go

@@ -79,6 +79,7 @@ func resetPassword(w http.ResponseWriter, r *http.Request) {
 		renderError(http.StatusInternalServerError, "Unable to process your request. Please try again later.")
 		return
 	}
+	defer conn.Close()
 
 	// Bind as service to perform the password change
 	err = conn.ServiceBind()