feat(admin): the admin lists as a people directory, the user form by what it allows

The Users, Groups and Removed VMs pages were bare tables: rows of
coloured icon buttons without words, five columns of small checks for
a user's role and permissions, dates broken over three lines and a
lone "+" for a new entry. The owner chose a directory layout from three
rendered options; it follows the host pages' cards:

- Each list is a card with its count and search in the header and one
  list-group item per entry, which stacks on a phone without scrolling.
- A user shows their role as a badge (Superuser, Template editor) or
  "User", Blocked as a red badge, their groups, a granted clone
  permission and live API tokens, and the last login on one line;
  role and status are searchable. Edit is the visible action, the menu
  holds View profile, Block or Unblock and Delete; Block and Delete
  are disabled on one's own account, which the server refuses anyway.
- A group shows its member and permission counts; its name opens it.
  The page's title said "Users".
- A removed VM shows its UUID, the host it left, its owners and when
  the record was made and expires.
- Logs keep their table in a card, the server search in its header,
  the count of matching rows, Done and Failed as badges, and a message
  column wide enough to read on a phone.

The user form was one long column of horizontal fields. The owner
rejected three boxed layouts and chose one led by what the user may
do: the Active switch, Template editor and Superuser as two cards,
groups as chips, the user's own permissions as switches each saying
what it allows, then the name and password and the quota folded into
details whose summaries tell their values (-1 as "any"); they open on
a new user and on an error inside them. A refused group or permission
is said beside its field. The group form follows it: the name, what
its members may do, its members as chips. Cancel goes back to the
list instead of the browser history.

admin/forms.py

@@ -13,6 +13,21 @@ from instances.models import Instance
 from .models import Permission
 
 
+# what each permission lets a user do, shown beside its switch
+PERMISSION_HELP = {
+    "change_password": _("Change their own password on their profile page"),
+    "clone_instances": _("Clone the VMs they may change and the templates they may view, within their quota"),
+    "passwordless_console": _("Open a console without the VM's console password"),
+    "snapshot_instances": _("Take, revert and delete snapshots of the VMs they may change"),
+    "view_instances": _("See every VM and host in the lists, read-only"),
+}
+
+
+def permission_rows(field):
+    """Each permission's checkbox of a bound field with what it lets a user do."""
+    return [(box, PERMISSION_HELP.get(box.data["value"].instance.codename, "")) for box in field]
+
+
 class GroupForm(forms.ModelForm):
     permissions = forms.ModelMultipleChoiceField(
         widget=forms.CheckboxSelectMultiple,
@@ -32,6 +47,9 @@ class GroupForm(forms.ModelForm):
         if instance and instance.id:
             self.fields["users"].initial = self.instance.user_set.all()
 
+    def permission_rows(self):
+        return permission_rows(self["permissions"])
+
     def save_m2m(self):
         self.instance.user_set.set(self.cleaned_data["users"])
 
@@ -76,6 +94,12 @@ class UserForm(UniqueEmailMixin, forms.ModelForm):
         labels = {"is_staff": _("Template editor")}
         help_texts = {"is_staff": _("May change and delete the template VMs given to them")}
 
+    def permission_rows(self):
+        return permission_rows(self["user_permissions"])
+
+    def identity_has_errors(self):
+        return any(self.has_error(name) for name in ("username", "password", "first_name", "last_name", "email"))
+
 
 class UserCreateForm(UserForm):
     password = forms.CharField(widget=forms.PasswordInput)