Function create_user 

pub async fn create_user(
    username: &str,
    plaintext: &str,
    database: Arc<Database>,
) -> Result<AdminUser, UserError>

Creates an operator.

Order matters: the policy is checked before the duplicate lookup, and the duplicate lookup before the (expensive) hash, so a rejected request never pays 600 000 iterations.