feat: create users with a password and an invitation in the admin

- password with confirmation on create, optional reset on update that
  ends the user's sessions; the hash is never returned
- send_invite sends one invitation with an activation link after the
  create commits
- organisation picker, avatar upload shared with the user API and the
  frontend permission editor on the user form
- an email held by a deactivated user answers 422 instead of failing
  on the unique constraint
- the privileged-member guard now also refuses a submitted password

models/user/fields.yaml

@@ -14,6 +14,41 @@ fields:
         type: text
         span: full
         tab: golem15.user::lang.user.account
+    send_invite:
+        label: golem15.user::lang.user.send_invite
+        comment: golem15.user::lang.user.send_invite_comment
+        type: checkbox
+        default: true
+        tab: golem15.user::lang.user.account
+        context: create
+    password:
+        label: golem15.user::lang.user.password
+        comment: golem15.user::lang.user.password_comment
+        type: password
+        span: left
+        tab: golem15.user::lang.user.account
+        context: [create, update]
+    password_confirmation:
+        label: golem15.user::lang.user.confirm_password
+        comment: golem15.user::lang.user.confirm_password_comment
+        type: password
+        span: right
+        tab: golem15.user::lang.user.account
+        context: [create, update]
+    organisation:
+        label: golem15.user::lang.organisation.label
+        type: relation
+        nameFrom: name
+        span: full
+        emptyOption: golem15.user::lang.organisation.empty_organisation
+        tab: golem15.user::lang.user.account
+    avatar:
+        label: golem15.user::lang.user.avatar
+        type: fileupload
+        mode: image
+        imageWidth: 260
+        imageHeight: 260
+        tab: golem15.user::lang.user.account
     created_ip_address:
         label: golem15.user::lang.user.created_ip_address
         type: text
@@ -26,3 +61,9 @@ fields:
         span: right
         tab: golem15.user::lang.user.account
         context: preview
+    permissions:
+        type: permissioneditor
+        mode: radio
+        span: full
+        tab: golem15.user::lang.user.permissions_tab
+        context: update