feat: backend support for creating and storing service accounts (#22698)

Add is_service_account column to users table with CHECK constraints
enforcing login_type='none' and empty email for service accounts.
Update user creation API to validate service account constraints.

Related to:
https://linear.app/codercom/issue/PLAT-27/feat-backend-support-for-creating-and-storing-service-accounts

coderd/database/migrations/testdata/fixtures/000432_pre_service_account_constraints.up.sql

@@ -0,0 +1,27 @@
+-- Fixture for migration 000433_add_is_service_account_to_users.
+-- Inserts a user with an empty email to ensure the migration
+-- correctly marks them as a service account before adding the
+-- users_email_not_empty constraint.
+
+INSERT INTO users (
+    id,
+    email,
+    username,
+    hashed_password,
+    created_at,
+    updated_at,
+    status,
+    rbac_roles,
+    login_type
+)
+VALUES (
+    '8ddb584a-68b8-48ac-998f-86f091ccb380',
+    '',
+    'fixture-empty-email-user-to-service-account',
+    '',
+    '2024-01-01 00:00:00+00',
+    '2024-01-01 00:00:00+00',
+    'active',
+    '{}',
+    'password'
+);

coderd/database/migrations/testdata/fixtures/000433_service_accounts.up.sql

@@ -0,0 +1,41 @@
+-- Fixture for migration 000433_add_is_service_account_to_users.
+-- Inserts multiple service accounts with empty emails to help test
+-- the down migration, which must assign each a unique placeholder
+-- email before restoring the original unique index on email.
+
+INSERT INTO users (
+    id,
+    email,
+    username,
+    hashed_password,
+    created_at,
+    updated_at,
+    status,
+    rbac_roles,
+    login_type,
+    is_service_account
+)
+VALUES (
+    'b2ce097d-2287-4d64-a550-ed821969545d',
+    '',
+    'fixture-service-account-1',
+    '',
+    '2024-01-01 00:00:00+00',
+    '2024-01-01 00:00:00+00',
+    'active',
+    '{}',
+    'none',
+    true
+),
+(
+    '3e218a4a-3b4a-4242-b24e-9430277e619d',
+    '',
+    'fixture-service-account-2',
+    '',
+    '2024-01-01 00:00:00+00',
+    '2024-01-01 00:00:00+00',
+    'active',
+    '{}',
+    'none',
+    true
+);