Adapt user endpoints to the 1.19 UserSource schema

[luke-]

Summary

Core 1.19 drops user.auth_mode and user.authclient_id. Provenance moves to user.user_source; external auth-client identities move into the user_auth table. This PR aligns the REST API accordingly.

• GET /user/get-by-authclient now looks up user_auth(source, source_id) only — the legacy column query would SQL-error on 1.19.
• Account responses expose user_source instead of authclient / authclient_id.
• Incoming authclient is still accepted as an alias for user_source for one release, so clients have a window to migrate.
• Swagger schema updated.
• CHANGELOG (Unreleased) heading bumped to 0.12.0 to match module.json (was still showing 0.11.3).

See also: humhub/humhub enh/user-source — UserSource refactoring on core.

Breaking changes (for clients)

• Response field rename: account.authclient → account.user_source. account.authclient_id is removed (external IDs are now per-AuthClient rows in user_auth, accessible via existing endpoints).
• Request bodies: account.authclient is mapped to user_source transparently; account.authclient_id is no longer accepted — use POST /user/{id}/auth-client to attach external identities.

Test plan

• GET /user/{id} returns user_source in the account object
• GET /user/get-by-authclient?name=ldap&id=<dn> returns the user after an LDAP login on 1.19
• POST /user with legacy account.authclient=local still creates a user with user_source=local
• POST /user with account.user_source=local creates a user with user_source=local