fix(auth): skip AD continuation referrals in LDAP search (0.2.1)

Active Directory answers any search based at a domain root with continuation
references (CN=Configuration, DC=ForestDnsZones, ...). With referral following
disabled -- the default, and what we want, since chasing one would re-bind
somewhere we never authenticated -- Novell surfaces each by throwing
LdapReferralException from Next().

That escaped NovellLdapConnection.Search, and LdapAuthService maps a failed
search to ServiceAccountBindFailed. So every login against
SearchBase = DC=nam,DC=zimmer,DC=com failed system-side on BOTH DCs in ~546 ms
while the directory, the credentials and the service account were all healthy.
Identical on each endpoint, so failover could not help either.

A continuation reference is a pointer to another naming context, never a
statement that this search failed, so the loop now skips them and continues --
returning exactly the entries in the naming context we bound to. Extracted as
ReadEntries(ILdapSearchResults) so the handling is unit-testable through the
Novell seam without a live directory. A 1000-referral cap guards a client that
throws without advancing, which would otherwise spin forever inside a
fail-closed auth path.

Non-referral faults still propagate untouched: swallowing those would turn
"the directory is broken" into "no such user", which is the wrong answer to
give about someone's credentials.

7 tests, 6 verified red against the pre-fix code; the seventh is the
non-referral control that must stay green either way. Suite 257/0, 2 skipped.

Live-proven against the ZB NAM domain root before and after.

ZB.MOM.WW.Auth/src/ZB.MOM.WW.Auth.Ldap/Internal/NovellLdapConnection.cs

@@ -99,23 +99,73 @@ internal sealed class NovellLdapConnection : ILdapConnection
             attributes.ToArray(),
             typesOnly: false);
 
+        return ReadEntries(results);
+    }
+
+    /// <summary>
+    /// Drains a result set into entries, <b>skipping continuation referrals</b>.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Active Directory answers any search based at a domain root with one or more
+    /// continuation references (to <c>CN=Configuration</c>, <c>DC=ForestDnsZones</c> and
+    /// friends). With referral following disabled — the default, and what we want, since
+    /// chasing a referral would re-bind somewhere we did not authenticate — Novell surfaces
+    /// each one by throwing <see cref="LdapReferralException"/> from <see cref="ILdapSearchResults.Next"/>.
+    /// </para>
+    /// <para>
+    /// A continuation reference is a <em>pointer to another naming context</em>, not an error:
+    /// it says "there may be more results over there", never that this search failed. Letting
+    /// it escape made the whole search stage fail, which <c>LdapAuthService</c> maps to
+    /// <see cref="Abstractions.Ldap.LdapAuthFailure.ServiceAccountBindFailed"/> — so against a
+    /// real AD domain root, every login failed with a system-side error while the directory,
+    /// the credentials and both DCs were perfectly healthy. Verified against
+    /// <c>DC=nam,DC=zimmer,DC=com</c> on 2026-08-12.
+    /// </para>
+    /// <para>
+    /// Skipping is the correct behaviour rather than a workaround: the entries we can see are
+    /// exactly the ones in the naming context we bound to, which is the set the caller asked
+    /// about. Internal so the referral handling can be unit-tested through the
+    /// <see cref="ILdapSearchResults"/> seam without a live directory.
+    /// </para>
+    /// </remarks>
+    internal static List<LdapSearchEntry> ReadEntries(ILdapSearchResults results)
+    {
         var entries = new List<LdapSearchEntry>();
-        while (results.HasMore())
+        var referrals = 0;
+
+        while (true)
         {
-            var entry = results.Next();
-            var attrs = new Dictionary<string, IReadOnlyList<string>>(StringComparer.OrdinalIgnoreCase);
-
-            foreach (LdapAttribute attr in entry.GetAttributeSet())
+            try
             {
-                attrs[attr.Name] = attr.StringValueArray.ToList();
-            }
+                if (!results.HasMore()) break;
 
-            entries.Add(new LdapSearchEntry(entry.Dn, attrs));
+                var entry = results.Next();
+                var attrs = new Dictionary<string, IReadOnlyList<string>>(StringComparer.OrdinalIgnoreCase);
+
+                foreach (LdapAttribute attr in entry.GetAttributeSet())
+                {
+                    attrs[attr.Name] = attr.StringValueArray.ToList();
+                }
+
+                entries.Add(new LdapSearchEntry(entry.Dn, attrs));
+            }
+            catch (LdapException ex) when (ex is LdapReferralException || ex.ResultCode == LdapException.Referral)
+            {
+                // Novell dequeues the reference before throwing, so the enumeration advances and
+                // this terminates. The cap is a belt-and-braces guard: a client that threw without
+                // advancing would otherwise spin forever inside a fail-closed auth path, which is a
+                // far worse failure than under-reporting an implausible number of referrals.
+                if (++referrals > MaxReferrals) break;
+            }
         }
 
         return entries;
     }
 
+    /// <summary>Upper bound on continuation references tolerated in one search — see <see cref="ReadEntries"/>.</summary>
+    private const int MaxReferrals = 1_000;
+
     /// <inheritdoc/>
     public void Dispose()
     {