feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

templates/swagger/v1-openapi3.generated.json

@@ -3707,6 +3707,25 @@
         "type": "object",
         "x-go-package": "gitea.dev/modules/structs"
       },
+      "ConvertUserTypeOption": {
+        "description": "ConvertUserTypeOption options when converting a user between individual and bot",
+        "properties": {
+          "user_type": {
+            "description": "The target user type",
+            "enum": [
+              "User",
+              "Bot"
+            ],
+            "type": "string",
+            "x-go-name": "UserType"
+          }
+        },
+        "required": [
+          "user_type"
+        ],
+        "type": "object",
+        "x-go-package": "gitea.dev/modules/structs"
+      },
       "CreateAccessTokenOption": {
         "description": "CreateAccessTokenOption options when create access token",
         "properties": {
@@ -10722,6 +10741,17 @@
             "type": "integer",
             "x-go-name": "StarredRepos"
           },
+          "type": {
+            "description": "the account type",
+            "enum": [
+              "User",
+              "Organization",
+              "Bot"
+            ],
+            "type": "string",
+            "x-go-enum-desc": "User UserTypeStringUser\nOrganization UserTypeStringOrganization\nBot UserTypeStringBot",
+            "x-go-name": "Type"
+          },
           "visibility": {
             "allOf": [
               {
@@ -12261,6 +12291,51 @@
         ]
       }
     },
+    "/admin/users/{username}/convert-type": {
+      "post": {
+        "operationId": "adminConvertUserType",
+        "parameters": [
+          {
+            "description": "username of the user to convert",
+            "in": "path",
+            "name": "username",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ConvertUserTypeOption"
+              }
+            }
+          },
+          "required": true,
+          "x-originalParamName": "body"
+        },
+        "responses": {
+          "204": {
+            "$ref": "#/components/responses/empty"
+          },
+          "400": {
+            "$ref": "#/components/responses/error"
+          },
+          "403": {
+            "$ref": "#/components/responses/forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/notFound"
+          }
+        },
+        "summary": "Convert an account between the user and bot types",
+        "tags": [
+          "admin"
+        ]
+      }
+    },
     "/admin/users/{username}/keys": {
       "post": {
         "operationId": "adminCreatePublicKey",