Accounts API shouldn't commit to a specific authentication mechanism

Currently, the Accounts API is a wrapper around and replacement for the "basic auth" authentication mechanism. It allows us to detect a failed basic authenication as well as to update credentials for a given basic authentication without having to update the permissions on every object in the database. However, because an authentication mechanism is "baked in" to the accounts API, these benefits do not apply in other cases, such as when someone using the Portier mechanism changes their email address, or when someone wants to change their authentication mechanism from Portier to FXA or vice versa.

To address this, we should allow an account to be created with any authentication mechanism rather than just a username and password.

Start by reading the Accounts API entry point and the existing basic-authentication flow. Trace how accounts create, detect failed authentication, and update credentials, then compare that behavior with Portier and FXA. Done means the API can create an account with an arbitrary authentication mechanism and supports changing mechanisms without updating permissions on every object.

Written by the indexing model from the issue text.