[Feature] Trusted Local Provisioning for Immich

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request. • Yes The feature Summary Add immich-admin provision-token, a server-local command that mints a short-lived admin session token for infrastructure automation running on the Immich host. The token is a normal Immich session token. It is then used against the existing admin API. Also allow UserAdminCreateDto.password to be omitted when OAuth is enabled. Together, these changes let declarative operators manage Immich users and OIDC without storing a long-lived admin API key, scraping the UI, or writing directly to the database. Motivation Immich already supports most of the surfaces a declarative operator needs. System settings can come from IMMICH_CONFIG_FILE, OAuth settings are part of normal system config, and users can be reconciled through the admin API. The missing piece is bootstrap authentication for automation that already controls the…