[auth][graphql] patchUser resolver

[axiomofjoy]

mutation patchUser(
  userId: <id>,
  email: "user@domain.com",
  username: "username",
  password: "password",
  role: Admin,
) {
  user: {
    id
  }
}

Only admins should be able to patch users via the admin page. The user should be able to pass in only a subset of the fields in the resolver (e.g., only email).

We should guarantee that there is always one admin user at any given time by raising an error if changing the role of a user from admin to non-admin would result in there being no admin users left.

[mikeldking]

Is the intent that patch user would be only accessible to admins and there would be a different mutation for viewer? Worth considering that the "behavor" of whether or not the user has to reset the password should exist here.

[mikeldking]

Note we should probably invalidate all sessions (e.g. access tokens) when a user's credentials are changed AND when the user logs out