Function create_local 

pub async fn create_local(
    pool: &PgPool,
    actor: Option<&Actor>,
    input: NewLocalUser,
) -> AppResult<User>

Creates a local (password) account. actor = None is used by the CLI and the bootstrap logic.

Invariants

• Permission: administrator (403); without an actor (CLI, bootstrap) no check.
• Locks: none; a taken username is refused by the unique index (409).
• Data: the password is validated and stored only as a hash.
• Audit: user.create.
• Notifications / webhooks: none.
• Atomic: one transaction.