feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

admin/tests/smoke/preview.smoke.test.ts

@@ -102,7 +102,7 @@ describe('preview screen (UI-SPEC S3, D-11)', () => {
 
     const grid = wrapper.find('[data-preview] dl')
     expect(grid.exists()).toBe(true)
-    expect(grid.findAll('dt').map((item) => item.text())).toEqual(['Name', 'Email', 'Joined from IP address'])
+    expect(grid.findAll('dt').map((item) => item.text())).toEqual(['Name', 'Email', 'Slug', 'Joined from IP address'])
     expect(value(wrapper, 'name').text()).toBe('Ada Lovelace')
     expect(value(wrapper, 'email').text()).toBe('ada@example.test')
     // Values wrap and are never truncated; labels carry no required mark.