feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

cmd/admin_user.go

@@ -5,10 +5,26 @@ package cmd
 
 import (
 	"context"
+	"strings"
+
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 
 	"github.com/urfave/cli/v3"
 )
 
+// parseUserTypeFlag parses "--user-type", keeping the lowercase "individual" and "bot" the flag shipped with
+func parseUserTypeFlag(s string) (user_model.UserType, error) {
+	switch strings.ToLower(s) {
+	case "user", "individual":
+		return user_model.UserTypeIndividual, nil
+	case "bot":
+		return user_model.UserTypeBot, nil
+	default:
+		return 0, util.NewInvalidArgumentErrorf("invalid user type %q (expected User, Bot)", s)
+	}
+}
+
 func newUserCommand() *cli.Command {
 	return &cli.Command{
 		Name:  "user",
@@ -24,6 +40,7 @@ func newUserCommand() *cli.Command {
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
 			microcmdUserDisableTwoFactor(),
+			microcmdUserChangeType(),
 		},
 	}
 }