Let instance admins create bot accounts from the web UI

What

The instance Accounts page now has a Create a bot account form beside the person invitation. It collects a name, an SSH public key, and an instance role, then calls the same identity.CreateBot the local and remote admin CLIs use.

Why

Bots have no browser sign-in, so the only creation path in the web UI — an enrollment link — cannot work for them. An instance admin had to leave the browser and hold either the config file or an admin key to set up a runner or other automation. Closes #187.

Details

• POST /users/bots requires the instance-admin role, CSRF, a valid role, and a non-empty key. It redirects to the new account page.
• The bot role picker omits admin; the identity layer still refuses it if the field is posted directly.
• A bot is marked in the accounts table and on its account page. Its page no longer offers an enrollment link, and its role picker leaves out admin.
• The accounts page copy now names both paths, and the accounts documentation says the web UI can create a bot.

Tests

TestAdminCreatesBotAccount covers the form, a successful create, the bot marker, the missing-key and admin-role refusals, and the non-admin 404. TestAdminUsersLifecycle keeps covering the person invitation path.

vole workflow check and vole workflow run verify both pass.

Checklist

• Relevant checks pass
• Copy reviewed for the person using the page
• Docs updated