Memberships: groups kept by portal itself, a person by phone number first

A membership is a case in the built-in portal_memberships bucket:
invited by a desk, a grants, the seed or the responsible pass; active
from the person's first sign-in, when the provider's subject, phone
number or address matches the record; removed by a desk, and invited
again after that. One record per group and person however it was
keyed, and at sign-in every record that matched learns what the
provider verified. The active memberships join the groups claim, so
Cedar sees the same parents as before.

PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN
means Kanidm. The NATS access service looks a person's groups up when
a question names them by sub, phone or email and lists none. The
sign-in asks for the phoneNumber scope and reads it from userinfo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

docs/access.md

@@ -4,6 +4,14 @@ Who may do what to what is compiled from content on every load into
 one Cedar policy set, and every server entry point asks that one
 policy. Identity stays Kanidm's; portal only decides.
 
+## Where the groups come from
+
+The policy names groups; it does not hold them. A `User` entity's
+parents are the person's groups, and those come from the sign-in: the
+`groups` claim the provider sent, joined with the person's active
+[memberships](memberships.md) when portal keeps them itself. Cedar
+sees one list either way.
+
 ## What content compiles to
 
 | content | rule |
@@ -42,6 +50,11 @@ Other applications ask the same question over NATS request-reply on
 and context the server uses internally — so an automation acting as a
 group gets exactly the answer a person in that group would.
 
+A principal may also name a person by `sub`, `phone` or `email` and
+list no groups; portal then looks their [memberships](memberships.md)
+up before deciding. That is what makes the policy usable for someone
+who has never opened the site.
+
 ## The submitter
 
 A person who sent a form has no account. Their credential is the link: