Introduce an "Identity" model to ease login

- New untenanted Identity and Membership models
- New `identity_token` cookie with path "/" holds state across tenants

We're not sure whether the untenanted database will be sqlite or
MySQL, and so I've been careful to minimize

- database reads, placing them behind etags and caching
- database writes, only writing when a new Session is created (login)

Note that we track two things in the identity_token cookie: a signed
id, and the updated_at for the underlying Identity object. This allows
us to effectively cache on the Identity without having to hit the
database, by using an Identity::Mock object that is compatible with
etag and cache methods.

The new integration test shows the desired user-facing behavior, which
is to make it easy to login without a tenanted URL and to jump between
tenants.

- the untenanted "login_help" page shows all linked memberships
- the jump menu shows all linked memberships (except the current)

Also introduced a utility script to populate existing employee
Identities, grouping accounts by email address.

config/database.yml

@@ -16,6 +16,10 @@ development:
     <<: *default
     database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3
     tenanted: true
+  untenanted:
+    <<: *default
+    database: storage/untenanted/development.sqlite3
+    migrations_paths: db/untenanted_migrate
   cable:
     <<: *default
     database: storage/development_cable.sqlite3
@@ -33,9 +37,14 @@ development:
 # re-generated from your development database when you run "rake".
 # Do not set this db to the same as development or production.
 test:
-  <<: *default
-  database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3
-  tenanted: true
+  primary:
+    <<: *default
+    database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3
+    tenanted: true
+  untenanted:
+    <<: *default
+    database: storage/untenanted/test.sqlite3
+    migrations_paths: db/untenanted_migrate
 
 production: &production
   primary:
@@ -44,11 +53,10 @@ production: &production
     tenanted: true
     extensions:
       - <%= SqliteVec.loadable_path %>
-  primary_original:
+  untenanted:
     <<: *default
-    database: storage/production.sqlite3
-    replica: true
-    readonly: true
+    database: storage/untenanted/production.sqlite3
+    migrations_paths: db/untenanted_migrate
   cable:
     <<: *default
     database: storage/production_cable.sqlite3