Adopt a member the portal vouches for

A share link admits somebody at the portal, so this instance first hears of
them when they arrive rather than when a superuser types their code in.
An unmapped portal identity is now checked once against the portal's own
list of who may reach this instance and given an ordinary local account
only if the portal vouches for it.

Asking rather than believing the token is the point: a token stays signed
and valid until it expires, so trusting its claims would let one rebuild
the account somebody deleted here and deleting a user would stop being the
whole of the revocation.

The account-making itself moved out of the route, since both ways in build
the same thing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GPMNwB2mGBP5j7dXRopcPH

frontend/src/components/UserSettings/RemoteAccess.tsx

@@ -237,6 +237,8 @@ export function RemoteAccess() {
                 />
                 <p className="text-xs text-muted-foreground">
                   They get a code at fluksio.com → Instances → Join an instance.
+                  Or share a link from the portal's own Instances list, which
+                  needs nothing entered here.
                 </p>
               </div>
               <div>