feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/relation_form.go

@@ -19,6 +19,8 @@ import (
 // plugin extensions need a parent record scope a child modal does not have.
 var relationFormRefusedTypes = map[string]bool{
 	"relation": true, "relation-manager": true, "widget": true, "partial": true,
+	// A password is a virtual field, and only an admin controller lists those.
+	"password": true,
 }
 
 // pivotFieldPattern is WinterCMS's pivot form field name, pivot[column].
@@ -152,6 +154,9 @@ func compileRelationForm(pluginID string, ctl pact.AdminController, fsys fs.FS,
 		if relationFormRefusedTypes[field.Type] {
 			return nil, fail(fmt.Errorf("field %s: type %s is not supported in a relation form (%s)", field.Name, field.Type, purpose))
 		}
+		if field.Preset != nil {
+			return nil, fail(fmt.Errorf("field %s: preset is not supported in a relation form (%s)", field.Name, purpose))
+		}
 		if cr.hasMany() && field.Name == cr.Contract.ForeignKey {
 			return nil, fail(fmt.Errorf("field %s is the relation's ForeignKey; the server sets it", field.Name))
 		}