api: fine-grained permission control for service account creation

[alvarofraguas]

Summary

• Adds optional user_access, query_access, carve_access, and admin_access fields to the user creation API endpoint
• When provided, these override the legacy behavior where all permission levels were derived from the binary admin flag
• Enables creating service accounts with specific permission combinations (e.g. read + query for monitoring, read + carve for forensics)

Backward compatibility

Fields use pointer types (*bool) so nil (not provided) is distinguishable from false (explicitly denied). When none of the new fields are provided, the handler falls back to the existing behavior: user_access=true, everything else = admin value.

Existing API clients and the CLI continue working unchanged.

API usage

POST /api/v1/users/my-monitoring-bot/add
{
  "username": "my-monitoring-bot",
  "password": "secure_password",
  "email": "monitoring@example.com",
  "service": true,
  "admin": false,
  "environments": ["env-uuid"],
  "user_access": true,
  "query_access": true,
  "carve_access": false,
  "admin_access": false
}

Security

The endpoint is already gated behind global admin permission (AdminLevel check). Only admins can create users or assign permissions. This change adds granularity to what admins can already do — it does not expand the attack surface.

Closes #774

Test plan

• go build ./... clean
• go test ./cmd/api/... ./pkg/users/... passes
• Legacy behavior preserved: omitting new fields produces same permissions as before
• Fine-grained: admin=false + query_access=true creates user with read + query only