hivectl: drop forge create-user; SSO makes a human's forge account

The forge now creates a human's account on their first authelia login,
so the verb has no job left. Deletes it, HostRequest::ForgeCreateUser,
its handler, provision_user_token, change_user_password and the hive's
TOKEN_SCOPES. change_user_password also passed the password as an
argument to `forgejo admin user change-password`, so it showed in the
container's process list.

ensure_user_exists and mint_token stay for the `core` bootstrap, their
one caller now. ensure_user_exists loses its password parameter: only the
deleted path set one.

Refs #3782

hivectl/src/main.rs

@@ -45,7 +45,7 @@ mod github;
 mod watch;
 use github::github_set_token;
 mod forge;
-use forge::{forge_create_user, forge_reconcile_config};
+use forge::forge_reconcile_config;
 mod agents;
 use agents::{agents_list, run_agent};
 mod power;
@@ -66,11 +66,6 @@ async fn main() -> Result<()> {
     let socket = cli.socket;
     match cli.cmd {
         Cmd::Forge { cmd } => match cmd {
-            ForgeCmd::CreateUser {
-                name,
-                password,
-                password_stdin,
-            } => forge_create_user(&socket, &name, password.as_deref(), password_stdin).await,
             ForgeCmd::ReconcileConfig {
                 agent,
                 from,