It is possible to define a privilege level on a Cisco router so that another user can run every command including the enable mode but not create or modify user accounts? How?
No. The privilege levels are predefined by Cisco and on the router itself there is not much in terms of editing that functionality.
What you can do though is setup TACACS and use that to authenticate. Then you can more easily define what functions certain accounts or groups can do. I do not have much experience with TACACS but I do know that accounts and groups are essentially role based and allowed certain functions based on assigned roles.
TACACS, I think, acts as the authenticator for people trying to login. So authentications are essentially passed to the server with TACACS installed.