feat(users): show API Only in the user list at a glance

[mastacontrola]

Follows #1330. The API-only flag was only visible by opening an account,
which is the wrong shape for the question people actually bring to a user
list: which of these are service accounts.

Its own column, not folded into API?

The two flags are independent and every combination is real. API? is
whether fog-user-token works for the account; this is whether the account
can sign in at all. A service account reachable only through an issued
Bearer token is API-only with API? off, and one cell cannot say that.

Not the check/cross pair

API? uses green check / red cross, where a cross means "switched off" — a
state somebody may want to change. Neither value here is a fault: an API-only
account is not broken, it is a different kind of account. So the pair is
"stands out" against "ordinary":

State	Badge
API-only	bg-warning + fa-key
Ordinary	bg-secondary + fa-user

Same two-badge shape as the protected column on images and snapins, which
is the established pattern in these grids.

fa-key rather than a robot because the bundled Font Awesome is 4.7.0,
which has no fa-robot; an icon the bundle does not carry renders as an empty
box with nothing logged. The test checks icon names against the stylesheet
that is actually served rather than against a list kept in the test, so it
stays true if the bundle is ever changed.

Tests

tests/user-list-columns.test.php, 10 checks, three mutation-verified: an
icon FA 4.7.0 lacks, a header cell the JS has no column for, and a renderer
pointed at the wrong target index.

Header/column drift is worth pinning because it is loud in a browser and
silent everywhere else — DataTables throws a warning dialog and renders no
rows, while source review, the rest of the suite and CI all pass.

The first version of the icon check scanned the whole JS file and failed on a
comment naming the icon it had chosen not to use — a gate tripping on prose
about itself. It strips comments now.

Not generalized across all eighteen list pages, though fourteen map
cleanly to one js file by their $node. task and host set headerData
five and seven times for different sub-grids, and storagenode builds its
header without _(), so counting _() calls reports 1 header cell against 6
columns for a page that is entirely correct. A gate that cannot tell a real
mismatch from its own parse failure is worse than no gate; doing it properly
needs the header parsed rather than pattern-counted.

Verified live

On a 1.6 install: an API-only account renders bg-warning/fa-key and an
ordinary one bg-secondary/fa-user, in a grid that loads its rows with no
DataTables warning. FOG_BCACHE_VER bumped so the changed JS is actually
served.

Downstream

None.