No way to merge two accounts belonging to the same person

A person who signs in with one provider and later signs in with a second gets
**two Plone accounts** — two userids, two profiles, two sets of local group
memberships and roles — with no way to tell the site they are one person.

The package already knows this state exists. `IdentityCollision` is raised
when an external identity is already linked to a different userid
(`core/interfaces.py:371`), and `/identities` lets a user link a second
provider to the account they are *signed in as*. Neither helps once the two
logins have already produced two accounts: linking requires being signed in
as the surviving account, and the identity is on the other one.

Proposed: a merge mechanism. Roughly, given a source and a target userid:

- move the source's external identities onto the target,
- move its profile email addresses across,
- union the group memberships and local roles,
- decide what happens to content the source account owns and to its audit
log entries,
- and leave a record that the merge happened.

Questions to settle before designing it:

- **Who may run it?** A Manager only, or may a user request a merge by
proving control of both — signing in as one and completing an
authorization flow for the other?
- **What is authoritative** when both accounts have a value: fullname, the
preferred email, the portrait?
- **Is the source deleted or tombstoned?** A deleted userid that owns content
is `PrincipalUnavailable` waiting to happen.
- Prevention as well as cure: should a login whose verified email matches an
existing account's verified email offer to link rather than provision a
second account? That is the same feature seen from the other end, and it is
where `create_user` (issue #6, already open) and the verification rules meet.