feat(12.1-02): password and form-only fields, rules per operation and preset

- pact.FormVirtualFields lists form fields that are not model columns: never
  bound, filled or projected; their values reach the Form hooks through
  cabana.VirtualFieldsFromContext when the field's context allows the operation
- type: password is a masked field that must be listed as virtual
- pact.FormRules supplies the rule set per operation and replaces the model's
  Rules() for admin saves; a rule on a virtual field sees the submitted value
- preset on a text field follows another text field on the create form
- SPA: PasswordField, preset handling in FormView, empty password left out of
  an update
- README, docs, OpenAPI document, TS types and dist updated

modules/pact/capabilities.go

@@ -486,6 +486,32 @@ type FormAfterDelete interface {
 	FormAfterDelete(ctx context.Context, model any) error
 }
 
+// FormVirtualFields optionally names fields of the controller's form that are
+// not model columns for the purpose of the form, such as a password and its
+// confirmation or a "send an invitation" checkbox. The admin framework never
+// binds such a field to a column, never fills it into the model and never
+// returns it in a record response. The values an administrator submits for
+// them reach the Form hooks (FormBeforeCreate, FormAfterCreate,
+// FormBeforeUpdate, FormAfterUpdate) through cabana.VirtualFieldsFromContext,
+// and only for the fields whose `context` allows the operation. Every name
+// must be a field of the form's fields.yaml of type password, text, textarea,
+// number, checkbox, switch or dropdown; a `type: password` field must be
+// listed here.
+type FormVirtualFields interface {
+	FormVirtualFields() []string
+}
+
+// FormRules optionally supplies the validation rules of an admin save. op is
+// "create" or "update". When a controller implements it, the returned set
+// replaces the model's Rules() for saves through the admin form; the form's
+// `required` flags are still merged in. Rule strings use the tokens
+// lagoon.Validate supports. A rule may name a field listed by
+// FormVirtualFields: it is then checked against the submitted value, never
+// against a model column of the same name.
+type FormRules interface {
+	FormRules(ctx context.Context, op string) map[string]string
+}
+
 // RelationExtendManageQuery optionally narrows relation-manager candidates.
 type RelationExtendManageQuery interface {
 	RelationExtendManageQuery(ctx context.Context, relation string, db *gorm.DB) *gorm.DB