Make user API client return JSON, not a model

The data flow of other bits of our application looks like this:
```
                         API (returns JSON)
                                  ⬇
          API client (returns a built in type, usually `dict`)
                                  ⬇
          Model (returns an instance, eg of type `Service`)
                                  ⬇
                         View (returns HTML)
```
The user API client was architected weirdly, in that it returned a model
directly, like this:

```
                         API (returns JSON)
                                  ⬇
    API client (returns a model, of type `User`, `InvitedUser`, etc)
                                  ⬇
                         View (returns HTML)
```

This mixing of different layers of the application is bad because it
makes it hard to write model code that doesn’t have circular
dependencies. As our application gets more complicated we will be
relying more on models to manage this complexity, so we should make it
easy, not hard to write them.

It also means that most of our mocking was of the User model, not just
the underlying JSON. So it would have been easy to introduce subtle bugs
to the user model, because it wasn’t being comprehensively tested. A lot
of the changed lines of code in this commit mean changing the tests to
mock only the JSON, which means that the model layer gets implicitly
tested.

For those reasons this commit changes the user API client to return
JSON, not an instance of `User` or other models.

tests/app/main/views/test_sign_in.py

@@ -4,6 +4,8 @@ import pytest
 from bs4 import BeautifulSoup
 from flask import url_for
 
+from app.models.user import User
+
 
 def test_render_sign_in_template_for_new_user(
     client
@@ -26,7 +28,7 @@ def test_sign_in_explains_session_timeout(client):
 
 
 def test_sign_in_explains_other_browser(logged_in_client, api_user_active, mocker):
-    api_user_active.current_session_id = str(uuid.UUID(int=1))
+    api_user_active['current_session_id'] = str(uuid.UUID(int=1))
     mocker.patch('app.user_api_client.get_user', return_value=api_user_active)
 
     with logged_in_client.session_transaction() as session:
@@ -43,7 +45,7 @@ def test_doesnt_redirect_to_sign_in_if_no_session_info(
     api_user_active,
     mock_get_organisation_by_domain,
 ):
-    assert api_user_active.current_session_id is None
+    assert 'current_session_id' not in api_user_active
 
     with client_request.session_transaction() as session:
         session['current_session_id'] = None
@@ -64,7 +66,7 @@ def test_redirect_to_sign_in_if_logged_in_from_other_browser(
     db_sess_id,
     cookie_sess_id
 ):
-    api_user_active.current_session_id = db_sess_id
+    api_user_active['current_session_id'] = db_sess_id
     mocker.patch('app.user_api_client.get_user', return_value=api_user_active)
     with logged_in_client.session_transaction() as session:
         session['current_session_id'] = str(cookie_sess_id)
@@ -104,7 +106,7 @@ def test_process_sms_auth_sign_in_return_2fa_template(
             'password': password})
     assert response.status_code == 302
     assert response.location == url_for('.two_factor', _external=True)
-    mock_verify_password.assert_called_with(api_user_active.id, password)
+    mock_verify_password.assert_called_with(api_user_active['id'], password)
     mock_get_user_by_email.assert_called_with('valid@example.gov.uk')
 
 
@@ -124,8 +126,8 @@ def test_process_email_auth_sign_in_return_2fa_template(
             'password': 'val1dPassw0rd!'})
     assert response.status_code == 302
     assert response.location == url_for('.two_factor_email_sent', _external=True)
-    mock_send_verify_code.assert_called_with(api_user_active_email_auth.id, 'email', None)
-    mock_verify_password.assert_called_with(api_user_active_email_auth.id, 'val1dPassw0rd!')
+    mock_send_verify_code.assert_called_with(api_user_active_email_auth['id'], 'email', None, None)
+    mock_verify_password.assert_called_with(api_user_active_email_auth['id'], 'val1dPassw0rd!')
 
 
 def test_should_return_locked_out_true_when_user_is_locked(
@@ -191,8 +193,10 @@ def test_email_address_is_treated_case_insensitively_when_signing_in_as_invited_
 ):
     sample_invite['email_address'] = 'TEST@user.gov.uk'
 
-    mocker.patch('app.user_api_client.get_user_by_email_or_none', return_value=api_user_active)
-    mocker.patch('app.main.views.sign_in._get_and_verify_user', return_value=api_user_active)
+    mocker.patch(
+        'app.models.user.User.from_email_address_and_password_or_none',
+        return_value=User(api_user_active),
+    )
 
     with client.session_transaction() as session:
         session['invited_user'] = sample_invite