feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

admin/src/components/form/registry.ts

@@ -10,6 +10,8 @@
 // routes against the form's session key (D-02, D-03), so it holds no form
 // value either and renders on create and update. The datepicker control is
 // a plain value field: its string value is part of the save body (D-18).
+// Phase 12.1 adds the password control: a plain value field whose value the
+// server never sends back, so it is empty on load and after every save.
 import type { Component } from 'vue'
 import CheckboxField from './fields/CheckboxField.vue'
 import DatepickerField from './fields/DatepickerField.vue'
@@ -17,6 +19,7 @@ import DropdownField from './fields/DropdownField.vue'
 import FileuploadField from './fields/FileuploadField.vue'
 import NumberField from './fields/NumberField.vue'
 import PartialField from './fields/PartialField.vue'
+import PasswordField from './fields/PasswordField.vue'
 import RelationManager from '../relation/RelationManager.vue'
 import RelationField from './fields/RelationField.vue'
 import SwitchField from './fields/SwitchField.vue'
@@ -52,6 +55,7 @@ const renderers = new Map<string, Component>([
   ['partial', PartialField],
   ['fileupload', FileuploadField],
   ['datepicker', DatepickerField],
+  ['password', PasswordField],
 ])
 
 /** Types whose control shows the label itself (toggle cards, relation manager). */