Introduce an "Identity" model to ease login

- New untenanted Identity and Membership models
- New `identity_token` cookie with path "/" holds state across tenants

We're not sure whether the untenanted database will be sqlite or
MySQL, and so I've been careful to minimize

- database reads, placing them behind etags and caching
- database writes, only writing when a new Session is created (login)

Note that we track two things in the identity_token cookie: a signed
id, and the updated_at for the underlying Identity object. This allows
us to effectively cache on the Identity without having to hit the
database, by using an Identity::Mock object that is compatible with
etag and cache methods.

The new integration test shows the desired user-facing behavior, which
is to make it easy to login without a tenanted URL and to jump between
tenants.

- the untenanted "login_help" page shows all linked memberships
- the jump menu shows all linked memberships (except the current)

Also introduced a utility script to populate existing employee
Identities, grouping accounts by email address.

db/untenanted_migrate/20250924190529_create_identities.rb

@@ -0,0 +1,7 @@
+class CreateIdentities < ActiveRecord::Migration[8.1]
+  def change
+    create_table :identities do |t|
+      t.timestamps
+    end
+  end
+end

db/untenanted_migrate/20250924190729_create_memberships.rb

@@ -0,0 +1,15 @@
+class CreateMemberships < ActiveRecord::Migration[8.1]
+  def change
+    create_table :memberships do |t|
+      t.string :email_address, null: false
+      t.references :identity, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: false, index: false
+      t.string :user_tenant, null: false
+      t.string :account_name, null: false
+
+      t.timestamps
+    end
+    add_index :memberships, :email_address
+    add_index :memberships, [ :user_tenant, :user_id ]
+  end
+end

db/untenanted_schema.rb

@@ -0,0 +1,33 @@
+# This file is auto-generated from the current state of the database. Instead
+# of editing this file, please use the migrations feature of Active Record to
+# incrementally modify your database, and then regenerate this schema definition.
+#
+# This file is the source Rails uses to define your schema when running `bin/rails
+# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
+# be faster and is potentially less error prone than running all of your
+# migrations from scratch. Old migrations may fail to apply correctly if those
+# migrations use external dependencies or application code.
+#
+# It's strongly recommended that you check this file into your version control system.
+
+ActiveRecord::Schema[8.1].define(version: 2025_09_24_190729) do
+  create_table "identities", force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+  end
+
+  create_table "memberships", force: :cascade do |t|
+    t.string "account_name", null: false
+    t.datetime "created_at", null: false
+    t.string "email_address", null: false
+    t.integer "identity_id", null: false
+    t.datetime "updated_at", null: false
+    t.integer "user_id", null: false
+    t.string "user_tenant", null: false
+    t.index ["email_address"], name: "index_memberships_on_email_address"
+    t.index ["identity_id"], name: "index_memberships_on_identity_id"
+    t.index ["user_tenant", "user_id"], name: "index_memberships_on_user_tenant_and_user_id"
+  end
+
+  add_foreign_key "memberships", "identities"
+end