Implement foundation of per-account passcodes.

Here's the scheme:

- The account model provides the passcode management interface.
- Accounts can have passcodes and timeouts associated with them
  - per device,
  - preserved across logins.
- During account login, the account activates the passcode in the app
  - and deactivates upon logout.
  - There is never an active passcode when no account is logged in.
- Cancelling passcode from challenge screen, while passcode is active:
  - Logs out active account
  - and removes passcode from account.
  - So user isn't locked out for forgotten passcode,
  - but intruders don't get account access by cancelling.
    - because they still have to log in to the account to access it.
  - notification of cancelled passcode is posted on next login to account

The basic facility is implemented. It builds on @devgeeks app-wide
passcode, with the account model coordinating the existing
infrastructure according to the account-specific passcode settings.

Not yet implemented: tests, the password challenge-screen cancel, and
cancelled-password notification.