feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/relation_child.go

@@ -113,7 +113,7 @@ func (s RelationService) fillChild(ctx context.Context, tx *gorm.DB, form *Compi
 			return &CapabilityError{ControllerID: controllerID(form)}
 		}
 	}
-	rules := mergedRules(form, model, op)
+	rules := mergedRules(ctx, form, model, op)
 	msgs, err := lagoon.Validate(ctx, tx, model, rules, valuesForRules(model, rules), nil)
 	if err != nil {
 		return &CapabilityError{ControllerID: controllerID(form)}