Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0251, issue 247)

A module puts the operator's account in a group by declaring the account with that group alone.
The node-engine now records each group it added, takes back only those when nothing declared still
asks for them, refuses a group the machine lacks before usermod runs, and states each such account
as its module's resource of kind account: relogin needed while the running session lacks the group.

internal/store/store.go

@@ -117,6 +117,13 @@ type Applied struct {
 	// still has the mesh's; absent when the mesh never changed it.
 	Linger *Lingering `json:"linger,omitempty"`
 
+	// Groups is, for a user, every group the mesh put the account in that it was not in before
+	// (novox/hq ADR 0251). Never a group the account was found in: that one is the machine's, or the
+	// operator's, and stays when the resource goes. Removal takes the account out of each of these that
+	// no other declared resource still asks for. Absent on a record written before the host kept it,
+	// and then every group is left as it is.
+	Groups []string `json:"groups,omitempty"`
+
 	// Unpacked is, for an archive, what it put on the machine (novox/hq issue 162): the files and
 	// directories it unpacked, and whether the directory it was unpacked into and the parents above
 	// it were made by the host. Removal takes away exactly that and nothing else. Absent on a