feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

options/locale/locale_en-US.json

@@ -129,9 +129,10 @@
   "confirm_delete_artifact": "Are you sure you want to delete the artifact '%s'?",
   "archived": "Archived",
   "concept_system_global": "Global",
-  "concept_user_individual": "Individual",
+  "concept_user_user": "User",
   "concept_code_repository": "Repository",
   "concept_user_organization": "Organization",
+  "concept_user_bot": "Bot",
   "show_timestamps": "Show timestamps",
   "show_log_seconds": "Show seconds",
   "show_full_screen": "Show full screen",
@@ -3069,7 +3070,6 @@
   "admin.users.admin": "Admin",
   "admin.users.restricted": "Restricted",
   "admin.users.reserved": "Reserved",
-  "admin.users.bot": "Bot",
   "admin.users.remote": "Remote",
   "admin.users.2fa": "2FA",
   "admin.users.repos": "Repos",
@@ -3082,6 +3082,12 @@
   "admin.users.impersonate": "Impersonate",
   "admin.users.impersonate_stop": "Stop impersonating",
   "admin.users.impersonating_notice": "You are impersonating <strong>%s</strong>. Actions you take are performed as this user.",
+  "admin.users.user_type": "User Type",
+  "admin.users.convert_type.not_convertible": "This user type cannot be converted. Only user and bot accounts support type conversion.",
+  "admin.users.convert_type.admin_not_allowed": "Administrators cannot be converted into bot accounts. Remove the administrator permission first.",
+  "admin.users.bot_token_desc": "Bot accounts cannot sign in, so their access tokens are managed here by administrators.",
+  "admin.users.bot_token_only": "Access tokens can only be generated for bot accounts here.",
+  "admin.users.impersonate_bot_not_allowed": "Bot accounts are non-interactive and cannot be impersonated.",
   "admin.users.auth_source": "Authentication Source",
   "admin.users.local": "Local",
   "admin.users.auth_login_name": "Authentication Sign-In Name",