Prevent mailing lists from being bin/auth recover'd

Summary:
Fixes T9610.

• We currently permit you to bin/auth recover users who can not establish web sessions (but this will never work). Prevent this.
• We don't emit a tailored error if you follow one of these links. Tailor the error.

Even with the first fix, you can still hit the second case by doing something like:

• Recover a normal user.
• Make them a mailing list in the DB.
• Follow the recovery link.

The original issue here was an install that did a large migration and set all users to be mailing lists. Normal installs should never encounter this, but it's not wholly unreasonable to have daemons or mailing lists with the administrator flag.

Test Plan:

• Tried to follow a recovery link for a mailing list.
• Tried to generate a recovery link for a mailing list.
• Generated and followed a recovery link for a normal administrator.

{F906342}

epriestley@orbital ~/dev/phabricator $ ./bin/auth recover tortise-list
Usage Exception: This account ("tortise-list") can not establish web sessions, so it is not possible to generate a functional recovery link. Special accounts like daemons and mailing lists can not log in via the web UI.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T9610

Differential Revision: https://secure.phabricator.com/D14325