Document primary groups and cross-group projects

[folker]

What changed

• define one primary group per RCC user
• assign external users to the collab primary group
• explain projects as explicit collaboration boundaries for exchanging data across groups
• distinguish primary-group storage from project storage
• add the concept page to both navigation systems and cross-link related guidance
• add regression coverage for the identity and access model

Why

The documentation described Unix and project groups but did not state the
complete RCC identity model, especially the collab assignment for external
users or the separation between affiliation and project access.

User impact

Users can now tell where their account belongs, how external collaborators are
represented, and why cross-group exchange should happen through explicit
project membership rather than broad permissions or a primary-group change.

Validation

• 79 repository tests passed
• 6 protected-app tests passed
• generated-site link check passed
• publication lint passed