Link a pending portal member to the local user with their email

A portal identity whose email a local user already has is still refused
on arrival. POST /cloud/members/{portal_sub}/link lets a superuser map it
onto that user, never a superuser's, after the portal confirms the
membership. GET /cloud/members marks such members linkable, and Admin →
Users offers "Link portal account" for them, saying that a linked user is
deleted with a removal at the portal or a Disconnect.

docs/interface/portal.md

@@ -56,6 +56,12 @@ Somebody admitted by a link gets their local account the first time they open
 the instance. Until then they are listed under **Admin → Users → Pending portal
 members**, where you can revoke the invitation.
 
+If a local user already has their email, they are refused rather than handed
+that account. A superuser can press **Link portal account** beside them to let
+them in as that user, who keeps their local password. Superuser accounts
+cannot be linked. A linked user counts as a portal user from then on, so
+removing them at the portal, or disconnecting, deletes them.
+
 ## Hooks and agents through the portal
 
 The portal also forwards a flow's hooks and the MCP endpoint, so they work