auth: create-user 400s when a password is typed while `generatePassword` keeps its default (true)

[baozhoutao]

Problem

In the console Setup app, the Create User dialog defaults generatePassword: true (checked). If the admin also types a password — which the field label explicitly invites: "Password (leave empty to generate)" — the request carries both:

{
 "generatePassword": true,
 "mustChangePassword": true,
 "email": "user@example.com",
 "name": "T1",
 "password": "A123456"
}

and POST /api/v1/auth/admin/create-user rejects it:

{"success": false, "error": {"code": "invalid_request", "message": "Provide either password or generatePassword, not both"}}

So the most natural flow — open dialog, type a password, submit — always fails. (The failure then also crashes the console page; that's a separate objectui bug: objectstack-ai/objectui#2579.)

Why the client can't fix this

The action-param visible CEL predicate (see packages/spec/src/ui/action.zod.ts) is evaluated once when the dialog opens and its scope is current_user / app / data / features — it cannot reference other params' live values, so the dialog can't hide/uncheck the checkbox when the admin starts typing a password.

Fix (server-side semantics)

resolvePassword in packages/plugins/plugin-auth/src/admin-user-endpoints.ts now treats an explicit non-empty password as an unambiguous override of generatePassword:

• explicit password present → use it (complexity-checked as before), temporaryPassword is not returned;
• password empty/absent + generatePassword: true → generate a temporary password (unchanged);
• neither → 400 (unchanged).

Applies to both create-user and set-password (newPassword). Backward compatible: the only behavior change is that a previously-rejected request now succeeds with the intent the label promised.