Settings resource; oauth2 app authorization model; UI cleanup

TODO.text

@@ -0,0 +1,21 @@
+- Tagline bug - cannot save with empty text
+- Profile photos
+    - Allow uploading/changing
+    - Default photo
+    - Expose photo endpoint for public services
+- App setup wizard
+- SAML IAM handling
+- LDAP IAM handling
+- User registration
+- Cobalt form JSON field type - Setting resource
+- MFA recovery codes handling
+- Forgot password handling
+    - Admin password reset mechanism -> flag users as needing PW resets
+    - Make this a general flow for pre-empting user logins
+- Cobalt form - when multiselect make selection box taller
+- Cobalt form - after action handlers
+    - e.g. after insert perform action
+    - e.g. after update perform action, &c.
+- IAM manage user API scopes
+- Eliminate LDAP group model, make LDAP server use standard auth group
+- OAuth2 -> support refresh tokens