TK-66: Search the Active Directory for the ISA Manager Contact

[burkkyy]

Fixes https://yg-hpw.atlassian.net/browse/TK-66

Context

When creating or editing an Information Sharing Agreement, the Manager contact must be searchable from the Active Directory so any Yukon Government employee can be named on the agreement — without being granted access to the agreement's group.

Previously the Manager field only searched existing app users, so employees who had never signed in could not be selected.

Implementation

1. Search the full Active Directory when naming the YG Manager contact on an Information Sharing Agreement, on both the create and edit forms.
2. Prefill the Manager field with the current contact when editing an existing agreement.
3. Resolve the selected Manager to an internal user record before saving — reusing the existing user when one already exists and creating one from the directory otherwise — and store the agreement against that user id.
4. Keep the Manager out of the agreement's group, so naming someone as Manager never grants them access to the agreement.

The agreement endpoints stay id-based; the client resolves the chosen directory email to a user through a dedicated directory-user endpoint, keeping the resolution out of the agreement controller.

Screenshots

Testing Instructions

1. Run the test suite via dev test.
2. Boot the app via dev up.
3. Log in to the app at http://localhost:3000.
4. Navigate to Information Sharing Agreements and start a new agreement.
5. In the Yukon Government (YG) Manager Contact Name field, search for a Yukon Government employee and select them. Verify the field accepts a directory result, not only existing app users.
6. Complete the remaining required fields and save. Verify the agreement is created and the selected Manager is not added to the agreement's group.
7. Open the agreement's basic information for editing. Verify the Yukon Government (YG) Manager Contact Name field prefills with the previously selected Manager.