feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/phase121_actions_test.go

@@ -304,7 +304,7 @@ func TestRecordActionSmoke(t *testing.T) {
 	})
 
 	t.Run("create and update responses carry no actions", func(t *testing.T) {
-		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Fresh"}`, "bearer")
+		rec := env.expect(t, http.StatusCreated, http.MethodPost, rosterPeople, `{"name":"Fresh","password":"long-enough-1","password_confirmation":"long-enough-1"}`, "bearer")
 		if strings.Contains(rec.Body.String(), `"actions"`) {
 			t.Fatalf("create response: %s", rec.Body.String())
 		}