fix(forms): never submit an invalid form; unlock password-change dialog

serializeObject() returns null for an invalid form, but most callers sent
the result anyway. Add $.fn.rejectInvalid (stop the spinner, let the
browser report the offending field) and use it at every call site.

Bugs fixed:
- Password change: on a mismatch the spinner kept running, and the custom
  validity on "npw" was never cleared, so the browser blocked every later
  submit even after the passwords matched. It is now cleared as soon as
  either password field is edited.
- sendForm: options.complete referenced an undefined jqXHR (ReferenceError)
  and an invalid form was posted with partial data.
- login.send: an invalid form threw a TypeError on qs.loginaccount.
- postXT({ form }): an invalid form was posted with empty data.
- Form dialogs without required fields had no "Bitte überprüfen Sie Ihre
  Eingaben" note, so a rejected submit showed nothing.

Hardening: null guards for the user, user-group, re-login, SMS password,
admin specialties and report-parameter submits.

Add e2e_tests/form-validation.cjs covering each path against the real
scripts; it fails on the previous code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Fuchs/wwwroot/web/fis.usr.de.js

@@ -152,6 +152,7 @@ let $usr = {
             submit: function (e) {
                 let c = $(this).ldng(1);
                 let qs = c.serializeObject(true, { typedvalues: true });
+                if (qs === null) { c.rejectInvalid(); return; }
                 $ocms.postXT({
                     url: $ocms.url('usr/create'), data: qs, success: function (response) {
                         alert(response.emailed === true ? $uct.create_sent : $uct.create_noemail);
@@ -187,6 +188,7 @@ let $usr = {
             submit: function (e) {
                 let c = $(this).ldng(1);
                 let qs = c.serializeObject(true, { typedvalues: true });
+                if (qs === null) { c.rejectInvalid(); return; }
                 $ocms.postXT({
                     url: $ocms.url('usr/pwdreset'), data: qs, success: function (response) {
                         alert(response.emailed === true ? $uct.pwdreset_sent : $uct.pwdreset_noemail);
@@ -208,6 +210,7 @@ let $usr = {
             submit: function (e) {
                 let c = $(this).ldng(1);
                 let qs = c.serializeObject(true, { typedvalues: true });
+                if (qs === null) { c.rejectInvalid(); return; }
                 $ocms.postXT({
                     url: $ocms.url('usr/email'), data: qs, success: function () {
                         c.trigger('modal_close');