feat: add governed LDIF contact imports

docs/ADDRESS_MODULE_ARCHITECTURE.md

@@ -187,9 +187,9 @@ successful search can infer deletion. A timeout, bind failure, malformed entry,
 duplicate key, or configured entry limit retains existing contacts and reports
 the source as failed/stale instead of creating tombstones.
 
-## Static Tabular Imports
+## Static Mapped Imports
 
-CSV and XLSX use versioned, scoped mapping profiles rather than live sync
+CSV, XLSX, and LDIF use versioned, scoped mapping profiles rather than live sync
 sources. Profiles retain delimiter, encoding, header or worksheet selection,
 stable source-key mapping, field mappings, locale and tags, row limits, and
 explicit duplicate, blank-value, and existing-contact policies. Updating a
@@ -207,6 +207,15 @@ matches its recorded post-apply hash. Arbitrary transforms remain Dataflow's
 responsibility; Files and Datasources are optional origins, not prerequisites
 for direct upload.
 
+LDIF is unfolded and parsed as a bounded stream of entries. Attribute names are
+case-insensitive; UTF-8 and base64-encoded text and repeated values are retained
+for mapping, while binary and URL values produce diagnostics and are never
+projected or fetched. The default change-record policy rejects change records.
+A profile can instead ignore them, or treat `changetype: add` as a static entry;
+modify and delete records are never translated into contact mutations. Entry
+hashes, input/plan hashes, mapping-version provenance, and the same correction
+and guarded rollback lifecycle apply as for CSV and XLSX.
+
 Persisted import runs can be resumed through `/address-book?import_run=<id>`.
 The WebUI reloads the bounded run projection, selects its address book and
 mapping version, and restores statistics, diagnostics, effects, and lifecycle