feat: create users with a password and an invitation in the admin

- password with confirmation on create, optional reset on update that
  ends the user's sessions; the hash is never returned
- send_invite sends one invitation with an activation link after the
  create commits
- organisation picker, avatar upload shared with the user API and the
  frontend permission editor on the user form
- an email held by a deactivated user answers 422 instead of failing
  on the unique constraint
- the privileged-member guard now also refuses a submitted password

views/mail/invite-en.htm

@@ -0,0 +1,13 @@
+subject = "An account has been created for you"
+description = "Invite a new user to the website"
+layout = "user"
+==
+Hello **{{ .Name }}**.
+
+An account has been created for you. Use the link below to activate it:
+
+[Activate your account]({{ .Link }})
+
+This link expires in {{ .Hours }} hours. If it has expired, ask your administrator for a new invitation.
+
+Your login: `{{ .Login }}`

views/mail/invite.htm

@@ -0,0 +1,13 @@
+subject = "Utworzono dla Ciebie konto"
+description = "Zaproszenie nowego użytkownika"
+layout = "user"
+==
+Cześć **{{ .Name }}**.
+
+Utworzono dla Ciebie konto. Aktywuj je, korzystając z poniższego linku:
+
+[Aktywuj konto]({{ .Link }})
+
+Link wygasa po {{ .Hours }} godz. Jeśli wygasł, poproś administratora o nowe zaproszenie.
+
+Twój login: `{{ .Login }}`