DRY out role creation helpers
Refactor user creation in all unit tests

As much as possible, all user creation now goes through helper function _make_user() in treemap/tests/__init__.py

Most tests now use either:
* make_commander_user() if they need to save things
* make_user_with_default_role() if they don't need to save things
Refactor role creation helpers to allow adding permissions easily
Satisfy flake8
Add InstanceUser model; move 'role' and 'repuation' from User model

3 migrations:
* Schema: create InstanceUser
* Data: create an InstanceUser for each existing role of each existing user
* Schema: remove 'roles' and 'reputation' from User
Update Role and Repuation code to access InstanceUser

A User object no longer has "roles" or "reputation" -- for that you need an InstanceUser.
My strategy is to mostly avoid accessing InstanceUser directly, using instead User methods
get_role(), get_reputation(), and get_instance_permissions(). (Internally these access
get_instance_user(), which is available when necessary.)

So in this commit we update all the code which interacts with role and reputation.

Note that like User.save(), InstanceUser.save() saves with the system_user.

One bug fix:
* In create_plot(), don't create plot if tree height is invalid
Update OTM1 migration logic to use InstanceUser

* Create an InstanceUser for each User, with the instance's default_role
* more_permissions() applies role to InstanceUser, not User