Create a client user

Creates a user of the client portal and sends him a welcome email with a generated password. The password is never published in the answer. The role is always client: the owner and the administrators of the account are not created here. An email address belongs to one user across the whole product, so an address already in use is refused with 409 USER_EMAIL_EXISTS. This endpoint ALWAYS asks for a confirmation -- there is no rehearsal of an email that has gone out -- and it spends one unit of the daily budget of calls that send email. Refusals: 400 VALIDATION_FAILED, UNKNOWN_PARAM, MISSING_REQUIRED_FIELD or INVALID_VALUE, 403 WRITE_ACCESS_DISABLED, 409 USER_EMAIL_EXISTS or PORTAL_NOT_CONFIGURED plus the confirmation and idempotency conflicts, 429 EMAIL_QUOTA_REACHED. The check that the portal can receive the user reads the account itself, so this endpoint declares 404 NOT_FOUND for the same defensive reason /v1/capabilities does. A user whose welcome email did not go out is still created and says so with the warning WELCOME_EMAIL_FAILED; he can use 'Forgot password' on the portal. if_version is not accepted.

Every write endpoint reads dry_run and idempotency_key; see the Write guarantees section of the introduction.