feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

models/user/user.go

@@ -68,6 +68,18 @@ const (
 	UserTypeRemoteUser // 5
 )
 
+// DisplayName returns the English name of the user type for logs and the CLI, the UI translates "concept_user_*" instead
+func (t UserType) DisplayName() string {
+	switch t {
+	case UserTypeOrganization, UserTypeOrganizationReserved:
+		return "Organization"
+	case UserTypeBot:
+		return "Bot"
+	default:
+		return "User"
+	}
+}
+
 const (
 	// EmailNotificationsEnabled indicates that the user would like to receive all email notifications except your own
 	EmailNotificationsEnabled = "enabled"
@@ -907,7 +919,7 @@ func GetVerifyUser(ctx context.Context, code string) (user *User) {
 	// use tail hex username query user
 	hexStr := code[base.TimeLimitCodeLength:]
 	if b, err := hex.DecodeString(hexStr); err == nil {
-		if user, err = GetUserByName(ctx, string(b)); user != nil {
+		if user, err = GetUserByName(ctx, string(b)); user != nil && user.IsIndividual() {
 			return user
 		}
 		log.Error("user.getVerifyUser: %v", err)
@@ -962,6 +974,9 @@ func ValidateUser(u *User, cols ...string) error {
 			return fmt.Errorf("visibility Mode not allowed: %s", u.Visibility.String())
 		}
 	}
+	if u.IsAdmin && u.IsTypeBot() {
+		return ErrBotCanNotBeAdmin
+	}
 
 	return nil
 }