remove default values from user constructors

Forcing every call site to be explicit about admin status and
password eliminates a class of bugs where an unintended
isAdmin=false or empty passwordHash could silently slip through.
The CreateUserTest case that asserted the isAdmin default is
dropped since the default no longer exists.

app/User/UseCases/CreateUserRequest.php

@@ -6,7 +6,7 @@ class CreateUserRequest
 {
     public function __construct(
         public ?string $email,
-        public ?string $password = null,
-        public bool $isAdmin = false,
+        public ?string $password,
+        public bool $isAdmin,
     ) {}
 }

app/User/User.php

@@ -9,8 +9,8 @@ class User
     public function __construct(
         private int $id,
         private EmailAddress $email,
-        private string $passwordHash = '',
-        private bool $isAdmin = false,
+        private string $passwordHash,
+        private bool $isAdmin,
     ) {}
 
     public function getId(): int