Handle duplicate email imports from otm1

This commit also contains the following improvements:
Fix how more_permissions reinstates previous roles
Drop out save with system user
Great big separate app commit
Move otm1 migrator to its own app
Replace the in-memory map of {otm1_pk: otm2_pk} with database models
Make the migrator idempotent
Uniquify duplicate usernames by adding an incremented suffix

Disable species test because species imports are currently broken.
Fix lint
Wrap model+relic saving in a transaction

Additionally, added a missing relic creation statement in the catch-all else block at the bottom of the main worker function. This wasn't a big problem because that code path is never executed.