Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0251, issue 247)

A module puts the operator's account in a group by declaring the account with that group alone.
The node-engine now records each group it added, takes back only those when nothing declared still
asks for them, refuses a group the machine lacks before usermod runs, and states each such account
as its module's resource of kind account: relogin needed while the running session lacks the group.

internal/link/messages.go

@@ -254,6 +254,12 @@ type Health struct {
 // service whose lifecycle is the machine's — said unhealthy for as long as it stays failed.
 const KindUnit = "unit"
 
+// KindAccount is an account a module puts in a group (novox/hq ADR 0251): a resource of the module, said
+// healthy when the account's running session has every group it declares, or nobody is logged in, and
+// unhealthy when the database does not list it in one, or its running session began before it was — the
+// reason then starting "relogin needed".
+const KindAccount = "account"
+
 // UnitsHealth is the machine's service managers in one statement (issue 315).
 type UnitsHealth struct {
 	// State is running, degraded — a unit failed, the modules' or the machine's — or unknown when no