Sign-in methods

Read the sign-in decision record in docs/decisions and the identities model. In settings, list each sign-in method with its provider, address and the date it was linked. Linking starts from a signed-in session after a fresh sign-in, so nobody can attach their own account to someone else's. Unlinking asks for a fresh sign-in too and refuses to remove the last method. For own passwords, let the user set or change a password here and end their other sessions after a change. Refuse an identity already tied to another user and never merge the two. On a hosted provider, use its linking API. Email the account whenever a method is added or removed, and add a test for each of these rules.