New EnvUser

Add:
 - the EnvUser doc
 - support for setting the last login time for the EnvUser
 - factory methods for adding the envuser

Create the Admin EnvUser at bootstrap time.
For both of these, we'd want the fully qualified name: "user@provider"

We know we'll need it later, and it makes sense to get it right from the start.