The "shape" of your JSON is different than the struct, so it may not be possible to restructure it with just annotations. You could implement your own manual deserialization, but it may be easier to just create 3 structs that model the JSON exactly, and then copy the data to the final struct.
I highly recommend using a 2-step approach: use Serde to read the input plain and then use the conversion protocols Rust gives you to construct your CreateUser out of it. Don't parse directly into your command structures!
This also give you the ability to insert validations between the two steps.