Add a users (logins) deduper

[maebeale]

🤖 suggested review level: 5 Inspect 🔬 deletes logins and changes the shared dedupe engine every deduper uses

Admins can now merge two logins into one — a person merge keeps both people's logins, and until now there was no way to fold the stale one away.

Users deduper (/users/dedupe_index)

• Candidates are logins that share a person. The suggested keeper is a login that can sign in, most recently used first.
• The pickers search every login, including unconfirmed, locked, and inactive ones, and label each with its status ("· Unconfirmed"). This uses a new virtual user_any_status search model; the shared user search is unchanged.
• The preview compares email, admin, confirmation, and sign-in history side by side.
• Blocked: logins of two different people (merge the people first), and merging away your own login.
• Notes: which email stops signing in; lost admin access; a person-less keeper takes over the person.
• Moves bookmarks, Ahoy events/visits, created_by/updated_by stamps, and paper_trail whodunnit.
• Entry points: a Dedupe link on Users, plus a "Dedupe users" admin-home card.

Shared engine changes (affect every deduper)

• reference_columns: — columns that point at the model without a DB foreign key. About 20 user stamp columns (grants, staff_tags, topic_subscriptions, …) and ahoy_events.user_id have none.
• Self-references on the model's own table now follow the keeper. This also covers organizations.parent_id and event_registrations.transferred_from_registration_id. The keeper's own reference to the duplicate clears instead of pointing at itself.
• A table that references the model twice gets one preview row per column ("Grants (created by)"). Before, index_by(label) hid one of them.
• dedupe_update_keep/dedupe_perform now accept only editable_columns when a config lists them. Before, they accepted every column (e.g. encrypted_password, super_user).
• The tracked dedupe.* event filters credential columns out of deleted_record. Emails are still kept for the audit trail.
• New view options record_label (two logins of one person share a name) and read_only_columns.

🤖 Generated with Claude Code

[maebeale]

@jmilljr24 we need this to resolve people merges that create a person w multiple users