make peruser resumable

(via https://github.com/apache/couchdb/pull/756#issuecomment-334919162)

couch_peruser doesn’t handle the case of the node it being run on failing and restarting. ~This is less an issue, if [Problem No. 1](https://github.com/apache/couchdb/pull/756#issuecomment-334919162) isn’t solved yet, as in a typical cluster there are at least two more instances of this module running that could create the database.~

~But say we fix Problem No. 1 (as outlined in https://github.com/apache/couchdb/pull/756#issuecomment-334919162) so that each user creation will only ever result in a single attempt to create the associated database. Then~ Now, what should happen if in between picking up the notification to create the database and doing the DB creation, the current node becomes unavailable?

The module currently opens _changes on startup and asserts all user/db creations corresponding to the _users db. That is, if there are 100k users, on startup, the module will try to create 100k databases, even if they already exist.

A solution to this would be to add per-node high-watermark _local/ docs, so we can more efficiently resume.

Start with the couch_peruser process that opens _changes on startup and processes user/database creation notifications. Review how it scans the _users database and consider the proposed per-node _local/ high-watermark documents as the recovery boundary. Done means a restarted node resumes without retrying every existing user/database creation.

Written by the indexing model from the issue text.