feat: create users with a password and an invitation in the admin

- password with confirmation on create, optional reset on update that
  ends the user's sessions; the hash is never returned
- send_invite sends one invitation with an activation link after the
  create commits
- organisation picker, avatar upload shared with the user API and the
  frontend permission editor on the user form
- an email held by a deactivated user answers 422 instead of failing
  on the unique constraint
- the privileged-member guard now also refuses a submitted password

plugin.go

@@ -189,6 +189,8 @@ func (p *Plugin) MailTemplates() []string {
 		"golem15.user::mail.restore-en",
 		"golem15.user::mail.reactivate",
 		"golem15.user::mail.reactivate-en",
+		"golem15.user::mail.invite",
+		"golem15.user::mail.invite-en",
 	}
 }