Make it possible to create a user through the API

[blaipr]

The bug

POST /api/v1/users could not create anybody. Every call answered:

{"error":{"message":"Error while doing the query",
          "detail":"SQLSTATE[HY000]: General error: 1364 Field 'pass' doesn't have a default value"}}

The controller built a User with no password; User.pass is NOT NULL with no default; the insert died on the database. The endpoint has never worked — found while writing the first tests for this family.

The fix

• Take the password as a required parameter, as the web form does. UserService::create() already hashes it.
• Keep it out of the answer. The create response echoes the user built from the request — the one object in the API that holds a password in the clear — so it goes through the same filter as the view and delete answers. The edit response too, for the same reason.

Testing

Extends UserControllerTest to 19 tests against the real REST dispatch and the real database:

• the created user is read back and every field asserted;
• the stored hash is checked against the password that was sent, so the account can actually be signed into afterwards;
• the plaintext appears nowhere in the response body;
• every required parameter refused when missing, a duplicate login, a group that does not exist;
• an edit does not disturb the stored password.

One gap recorded, not fixed

The user endpoints have no help class (the account, category, client, config, tag and group ones do), so a missing parameter comes back as Wrong parameters with an empty detail where the sibling endpoints name what was wrong. The test records that rather than asserting it is desirable.