accounts: specify accounts, sessions and permissions

[maxscharwath]

Epic for the accounts domain. Spec: docs/spec/accounts/README.md

Who is using the server, what they may see, how a device proves it is them, and what a television does about sessions it cannot easily renew.

How this epic works

Implementation and specification work hangs off this issue as sub-issues, so progress rolls up on the board without a hand-maintained checklist. Do not copy spec text into sub-issues — link to the section.

Done when

• Every section of docs/spec/accounts/README.md carries a status other than DRAFT
• The must-answer list in that file is empty
• Behaviour that ships in this domain matches what the spec claims