AdminAPI: make account confirmation idempotent

Currently in AdminAPI/AdminFE we have the ability to toggle confirmation. The API docs are misleading, because it actually does toggle it:

At a glance this seems like no problem, but it comes with the drawback that we can't send the welcome email after this action, because if an admin toggles it on and off it will send the welcome email repeatedly. So currently, it does not handle post-register actions from this endpoint.

There's also no good reason to de-confirm a user. In any case I can imagine, you would rather deactivate or delete the user.

I believe the field was meant to be idempotent. It's called :confirmation_pending (you can't "un-pend" something), so we should treat it that way. Additional fields like :deactivated can be used for subsequent moderation actions.

Related: !3068 (merged)