refactor(reorg): extract user + system_settings modules [6/10]

[valentijnscholten]

Stacked PRs

This is one of a stacked series that reorganizes dojo/ into self-contained dojo/{module}/ packages (matching the dojo/url/ reference). They are stacked — each PR is based on the previous one — so review and merge bottom-up in this order:

1. refactor(product_type): Extra ProductType models into dojo/product_type/ module [1/10] #14970 — product_type
2. refactor(test): Extract Test models into dojo/test/ module [2/10] #14971 — test
3. refactor(engagement): Extract Test models into dojo/test/ module [3/10] #14972 — engagement
4. refactor(product): Extract Product module into dojo/product/ [4/10] #14973 — product
5. refactor(finding): Reorganize finding into self-contained dojo/finding/ package [5/10] #14974 — finding (+ CWE & BurpRawRequestResponse fold-in)
6. refactor(reorg): extract user + system_settings modules [6/10] #14981 — peripheral: user + system_settings ◀ this PR
7. refactor(reorg): extract endpoint + tool_type/tool_config/tool_product modules [7/10] #14982 — peripheral: endpoint + tool_type/tool_config/tool_product
8. refactor(reorg): extract survey + benchmark modules [8/10] #14983 — peripheral: survey + benchmark
9. refactor(reorg): extract notes/note_type/file_uploads/reports/risk_acceptance [9/10] #14986 — peripheral: notes/note_type + file_uploads + reports + risk_acceptance
10. refactor(reorg): extract every type of class into modules [10/10] #14987 — peripheral: regulations + banner + announcement + development_environment + object

Merge #14970 first; each following branch is rebased onto the updated base and merged in turn. This PR continues the stack on top of #14974 — full implementation brief is the Phase 10 section in AGENTS.md.

Summary

Reorganizes the user and system_settings domains into self-contained dojo/user/ and dojo/system_settings/ packages with ui/ and api/ sub-packages, matching the dojo/url/ reference layout. Pure code-movement: no behaviour or migration changes; backward-compat re-exports keep external consumers working.

user (dojo/user/)

• Move Dojo_User, UserContactInfo, Contact into dojo/user/{models,admin}.py. Dojo_User is an FK target across many remaining models, so it is re-exported from dojo.models without # noqa: F401 (still referenced by remaining class bodies); the re-export sits at the earliest moved-class position so those FKs resolve.
• Move the user forms (DojoUserForm, AddDojoUserForm, EditDojoUserForm, DeleteUserForm, UserContactInfoForm) into ui/forms.py, UserFilter into ui/filters.py, and ApiUserFilter into api/filters.py. The filter re-exports in dojo/filters.py are dropped (they would cycle with DojoFilter); consumers repoint to the new paths.
• Move the user DRF serializers (UserSerializer, UserContactInfoSerializer, UserStubSerializer, AddUserSerializer, UserProfileSerializer) into api/serializer.py, re-exported from api_v2/serializers.py for prefetcher discovery and the remaining UserStubSerializer consumers. Move UsersViewSet, UserContactInfoViewSet, UserProfileView into api/views.py and add dojo/user/api/urls.py (add_user_urls), preserving the exact routes/basenames.
• Move views.py/urls.py into ui/, repointing the dojo/urls.py includes and dojo/metrics/views.py.

system_settings (dojo/system_settings/)

• Move System_Settings into dojo/system_settings/{models,admin}.py (no FK fields; the class-body System_Settings_Manager import is preserved). The dojo.models re-export is placed after the Dojo_User re-export because the manager pulls in dojo.middleware, which imports Dojo_User.
• Move SystemSettingsForm into ui/forms.py, SystemSettingsSerializer into api/serializer.py (re-exported for prefetcher discovery), and SystemSettingsViewSet into api/views.py with add_system_settings_urls, preserving the system_settings route/basename.
• Move views.py/urls.py into ui/, repointing the dojo/urls.py include.

[valentijnscholten]

We decided to go with the all-in-one PR10 from our list: #14987