The LDAP strategy's sign-in action (sign_in_with_<name>): runs
Macaw.Auth.Ash.Strategy.Ldap.sign_in/4 and returns the user, with a
user token in its :token metadata when the resource has tokens, as
the password strategy's sign-in does (unless the action's context sets
token_type to anything but :user).
Every refusal is the same AshAuthentication.Errors.AuthenticationFailed,
so neither AshAuthentication's plug nor an API built on the action tells
a wrong password from an unknown user; the reason is in its caused_by,
for logs.