Make "user role" editing more clear

Summary: The various interfaces here are in conflict about what a role is and isn't. Make them all consistent.

Test Plan: Edited some users into various roles, verified they reported correctly.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T1190

Differential Revision: https://secure.phabricator.com/D2415

src/docs/userguide/users.diviner

@@ -44,6 +44,11 @@ for them. System agents:
   - **can not review diffs or own tasks**;
   - **do not appear in CC tokenzers**.
 
+Currently, the **System Agent** role for an account can not be changed after the
+account is created. This prevents administrators form changing a normal user
+into a system agent, retrieving their Conduit certificate, and then changing
+them back (which would allow administrators to gain other users' credentials).
+
 = Disabled Users =
 
 **Disabled Users** are accounts that are no longer active. Generally, when