Memberships: groups kept by portal itself, a person by phone number first

A membership is a case in the built-in portal_memberships bucket:
invited by a desk, a grants, the seed or the responsible pass; active
from the person's first sign-in, when the provider's subject, phone
number or address matches the record; removed by a desk, and invited
again after that. One record per group and person however it was
keyed, and at sign-in every record that matched learns what the
provider verified. The active memberships join the groups claim, so
Cedar sees the same parents as before.

PEOPLE_BACKEND picks Kanidm or memberships; unset, a KANIDM_API_TOKEN
means Kanidm. The NATS access service looks a person's groups up when
a question names them by sub, phone or email and lists none. The
sign-in asks for the phoneNumber scope and reads it from userinfo.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GT37Z1Xtfd9pUuQtMTg6Yt

src/content/validate.rs

@@ -64,6 +64,17 @@ aggregates:
     transitions:
       open: [done, expired]
       expired: [open, done]
+  - bucket: portal_memberships
+    attended_by: the desks that list who is in a group; portal itself moves invited to active at sign-in
+    initial: invited
+    states:
+      invited: { event: invited }
+      active: { event: active }
+      removed: { event: removed }
+    transitions:
+      invited: [active, removed]
+      active: [removed]
+      removed: [invited, active]
   - bucket: portal_edit_suggestions
     attended_by: whoever keeps the content; every suggestion is mailed to the site's inbox too
     initial: open