feat(auth): automatic User Group assignment from Login Provider groups (#8129)

* feat(auth): automatic User Group assignment from Login Provider groups

Add per-Login-Provider "Auto Assignment" rules to the User Group editor so a
user is added to (or removed from) a Cacti User Group at every login based on
the groups their Login Provider reports.

User Group editor (user_group_admin.php):
- Add General / Auto Assignment / Rights spacers to the General tab and rename
  "General Group Options" to "Group Options".
- Render one text field per eligible Login Provider under Auto Assignment
  (label = provider name). The admin enters a plain Group Name (e.g.
  "Cacti Admins"), never a DN.
- Store the rules as JSON in the new user_auth_group.auto_assignments column,
  keyed by login_providers.id.

Group resolution:
- SAML2 and OpenID match the configured name against the group attribute /
  group claim values.
- LDAP/AD resolve membership live against the directory using a raw group name
  plus the Search Base, trying AD (memberOf + nested LDAP_MATCHING_RULE_IN_CHAIN),
  FreeIPA / 389 DS (groupOfNames/groupOfUniqueNames) and RFC2307 posixGroup
  shapes so one plain name works everywhere. This requires a directory-read
  bind, so the field is only offered for Anonymous Searching or Specific
  Searching with a stored service account.
- A directory that cannot be reached returns "undetermined" so existing
  memberships are left untouched rather than revoked on a transient outage.

Lifecycle:
- auto_assignments is reconciled on every login (lib/auth.php credential flow
  and login_sso.php redirect flow).
- Deleting a Login Provider strips its key from every group's auto_assignments.

Schema: add user_auth_group.auto_assignments (cacti.sql + 1_3_0 upgrade).

* ci: document free-text group-name validateInput for constraint ratchet

* fix(auth): address PR review on automatic User Group assignment

- LDAP: add an Active Directory bare-name query (objectClass=group with the
  member:1.2.840.113556.1.4.1941 nested-membership rule) so a plain group
  name resolves on AD, which neither the posixGroup nor groupOfNames probe
  could match.
- LDAP: make single-group membership tri-state and propagate an "undetermined"
  result, so a search that fails after binding (timeout/dropped connection) no
  longer looks like confirmed non-membership and revokes assignments.
- SAML2/OpenID: supportsAutoAssignment() now requires a configured group
  claim, and applyAutoAssignments() skips any provider that is not currently
  capable, so a blank claim can never strip users from their groups.
- Only reset the permission cache when a membership row actually changed
  (accumulate db_affected_rows) rather than on every login that has a rule.
- Add unit tests for the reconciliation boundaries (add / remove / no-op /
  incapable / undetermined) and for the LDAP group-query construction
  (AD plain + nested, posixGroup, groupOfNames, DN mode).
- Regenerate locales/po/cacti.pot for the new UI strings.

* fix(phpstan): resolve level-8 errors from auto group assignment

- Guard supportsAutoAssignment() behind an instanceof AbstractLoginProvider
  check so it is not called on the base LoginProviderInterface.
- Assign the injected field list to a variable (inject_form_variables takes it
  by reference) and pass an is_array-guarded group row.
- Bump the lib/ldap.php ldap_get_entries baseline count 3->6 for the three new
  group-membership query helpers.

locales/po/cacti.pot

@@ -8,9 +8,9 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Cacti 1.3.0.-1\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-09-28 15:59-0400\n"
+"POT-Creation-Date: 2026-10-01 18:09-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: Cacti Developers <developers@cacti.net>>\n"
+"Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
 "Language: \n"
 "MIME-Version: 1.0\n"
@@ -21188,6 +21188,16 @@ msgstr ""
 msgid "You must enter your GitHub user, repo and personal access token before you can refresh the plugins.  You can set the GitHub defaults under Console > Configuration > Settings > General."
 msgstr ""
 
+#: plugins.php
+#, php-format
+msgid "Plugin '%s' can not be Force Uninstalled because its directory is still present.  Use the normal Uninstall action instead."
+msgstr ""
+
+#: plugins.php
+#, php-format
+msgid "Plugin '%s' can not be Force Uninstalled because it is still required by: '%s'"
+msgstr ""
+
 #: plugins.php
 #, php-format
 msgid "Plugin '%s' has passed it's Configuration Check test and can not be Installed"
@@ -21206,6 +21216,18 @@ msgstr ""
 msgid "Are you sure you want to Uninstall?"
 msgstr ""
 
+#: plugins.php
+msgid "Are you sure you want to Force Uninstall?"
+msgstr ""
+
+#: plugins.php
+msgid "The directory for this Plugin is missing, so it can not be uninstalled normally.  Force Uninstall permanently removes all of its entries from the Cacti plugin tables (configuration, hooks, permissions, and any tables or columns it created).  This can not be undone.  If you really want to Force Uninstall the Plugin, click 'Force Uninstall' below.  Otherwise click 'Cancel'."
+msgstr ""
+
+#: plugins.php
+msgid "Force Uninstall"
+msgstr ""
+
 #: plugins.php
 msgid "Removing Plugin Data and Settings for will remove all Plugin Data and Settings.  If you really want to Remove Data and Settings for this Plugin, click 'Remove Data' below.  Otherwise click 'Cancel'."
 msgstr ""
@@ -21661,7 +21683,12 @@ msgid "Plugin was Disabled due to a Plugin Error.  Click to Re-enable the Plugin
 msgstr ""
 
 #: plugins.php
-msgid "Plugin directory is missing!"
+#, php-format
+msgid "Unable to Force Uninstall.  This Plugin is required by: '%s'"
+msgstr ""
+
+#: plugins.php
+msgid "Plugin directory is missing.  Click to Force Uninstall and remove all of its entries from the Cacti plugin tables."
 msgstr ""
 
 #: plugins.php
@@ -24136,7 +24163,7 @@ msgid "A more descriptive name for this group, that can include spaces or specia
 msgstr ""
 
 #: user_group_admin.php
-msgid "General Group Options"
+msgid "Group Options"
 msgstr ""
 
 #: user_group_admin.php
@@ -24147,6 +24174,10 @@ msgstr ""
 msgid "Allow Users of this Group to keep custom User Settings"
 msgstr ""
 
+#: user_group_admin.php
+msgid "Rights"
+msgstr ""
+
 #: user_group_admin.php
 msgid "Tree Rights"
 msgstr ""
@@ -24287,6 +24318,14 @@ msgstr ""
 msgid "Default Tree Policy for this User Group"
 msgstr ""
 
+#: user_group_admin.php
+msgid "If your IdP returns Group information and any of your users are a member of this group, they will be auto-added to it.  If, when they login, they are not a member of this group but have it assigned, they will be removed from it.  Enter the plain Group Name (for example \"Cacti Admins\"), not a full DN."
+msgstr ""
+
+#: user_group_admin.php
+msgid "Auto Assignment"
+msgstr ""
+
 #: user_group_admin.php
 msgid "Members"
 msgstr ""
@@ -24928,30 +24967,3 @@ msgstr ""
 #: vdef.php
 msgid "No VDEFs"
 msgstr ""
-
-#: plugins.php
-msgid "Plugin directory is missing.  Click to Force Uninstall and remove all of its entries from the Cacti plugin tables."
-msgstr ""
-
-#: plugins.php
-msgid "The directory for this Plugin is missing, so it can not be uninstalled normally.  Force Uninstall permanently removes all of its entries from the Cacti plugin tables (configuration, hooks, permissions, and any tables or columns it created).  This can not be undone.  If you really want to Force Uninstall the Plugin, click 'Force Uninstall' below.  Otherwise click 'Cancel'."
-msgstr ""
-
-#: plugins.php
-msgid "Are you sure you want to Force Uninstall?"
-msgstr ""
-
-#: plugins.php
-msgid "Force Uninstall"
-msgstr ""
-#: plugins.php
-msgid "Unable to Force Uninstall.  This Plugin is required by: '%s'"
-msgstr ""
-
-#: plugins.php
-msgid "Plugin '%s' can not be Force Uninstalled because its directory is still present.  Use the normal Uninstall action instead."
-msgstr ""
-
-#: plugins.php
-msgid "Plugin '%s' can not be Force Uninstalled because it is still required by: '%s'"
-msgstr ""