Phase 2: Modify `CreateUser` for atomic create+allocate+activate

[vihu]

Accept optional ResourceExtension accounts. When provided: atomic create → allocate → activate (status=Activated). When not provided: status=Pending (backward compatible).