Set actor properties when creating public link or app user

[ktuite]

This PR makes it possible to send actor properties in the POST creation request for app users and public links. Previously, you could only set the properties in a follow-up PATCH request.

This is a piece that was missing from #1824
Needed for

• Issue Assign user property values when creating an App User central#1339
• Frontend PR Set actor properties when creating app users or public links central-frontend#1557

What has been done to verify that this works as intended?

Tests, using it.

Why is this the best possible solution? Were any other approaches considered?

The response from the POST create event is the same as before - the properties have not been added to the response. This may be a little awkward, but the POST response is already different from the GET response because it contains the full session details, whereas the GET only contains the token from the session.

Example public link response from POST

  once: null,
  id: 10,
  type: 'public_link',
  displayName: 'test link',
  createdAt: '2026-05-27T20:19:54.422Z',
  updatedAt: null,
  deletedAt: null,
  token: 'eBKNv1ZebMm5kuEqbR9ucpuYZ3vkSJdrTgnJGOVaFXSNGj0WujEiUdZUK5Hkbaex',
  csrf: 'EaecdhEr4Y1sef5pmT6ifwUtIS8hg!QbwHaWVHld89pJcNauD8j1sC8XHECP!L2G',
  expiresAt: '9999-12-31T23:59:59.000Z'

from GET

  once: null,
  id: 10,
  type: 'public_link',
  displayName: 'test link',
  createdAt: '2026-05-27T20:19:54.421Z',
  updatedAt: null,
  deletedAt: null,
  token: 'eBKNv1ZebMm5kuEqbR9ucpuYZ3vkSJdrTgnJGOVaFXSNGj0WujEiUdZUK5Hkbaex'

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

Extends API for app user and public link creation to use new actor properties.

Does this change require updates to the API documentation? If so, please update docs/api.yaml as part of this PR.

Will update docs in followup PR

Before submitting this PR, please make sure you have:

• run make test and confirmed all checks still pass, or witnessed Github completing all checks with success
• verified that any code from external sources are properly credited in comments or that everything is internally sourced

[sadiqkhoja]

LGTM