feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

admin/openapi/admin.json

@@ -581,6 +581,21 @@
                 ],
                 "type": "object"
             },
+            "cabana.FieldPreset": {
+                "properties": {
+                    "field": {
+                        "type": "string"
+                    },
+                    "type": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "field",
+                    "type"
+                ],
+                "type": "object"
+            },
             "cabana.FileItem": {
                 "properties": {
                     "content_type": {
@@ -772,6 +787,14 @@
                         "description": "Path names the controller partial of a `type: partial` field: the\ntemplate {ConfigDir}/_{path}.htm (D-09).",
                         "type": "string"
                     },
+                    "preset": {
+                        "allOf": [
+                            {
+                                "$ref": "#/components/schemas/cabana.FieldPreset"
+                            }
+                        ],
+                        "description": "Preset makes a text field follow another field of the form while the\nadministrator has not edited it, on create only (fields.yaml preset)."
+                    },
                     "prompt": {
                         "description": "Prompt is the upload button text, localized per request.",
                         "type": "string"
@@ -3291,7 +3314,7 @@
         },
         "/{vendor}/{plugin}/{controller}/schema/form": {
             "get": {
-                "description": "The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint.",
+                "description": "The form of a controller, localized. `preview` is present when config_form.yaml declares a preview block: the form then has a read-only preview screen, which shows the fields whose context allows preview, the record actions and, when preview.headerPartial is set, that partial as a status hint. A `type: password` field and every other field the controller lists as virtual is sent in a save body and never has a value in a record response. `preset` on a text field names the field it follows on the create form (type slug or exact) until the administrator edits it.",
                 "parameters": [
                     {
                         "description": "Vendor",