feat: create users with a password and an invitation in the admin

- password with confirmation on create, optional reset on update that
  ends the user's sessions; the hash is never returned
- send_invite sends one invitation with an activation link after the
  create commits
- organisation picker, avatar upload shared with the user API and the
  frontend permission editor on the user form
- an email held by a deactivated user answers 422 instead of failing
  on the unique constraint
- the privileged-member guard now also refuses a submitted password

controllers/users/config_list.yaml

@@ -9,13 +9,14 @@ showSetup: true
 filter: config_filter.yaml
 
 toolbar:
-    buttons: [delete]
+    buttons: [create, delete]
     search:
         prompt: backend::lang.list.search_prompt
 
 bulkActions: [activate, deactivate, restore, ban, unban]
 
 messages:
+    create: golem15.user::lang.users.new_user
     empty: golem15.user::lang.users.list_empty
     deleteConfirm: golem15.user::lang.users.delete_selected_confirm
     deleted: backend::lang.messages.list.deleted