Introduce ServiceUser

Preperation for future features that require per-service user settings or state, e.g. stateful sync or service-specific email settings.

The additional JOIN due to ServiceUser degrades getusers API performance by 30-50%. For API calls that return many users, this is compensated by an otherwise unrelated optimization (selectinload instead of joinedload).

Prerequisite of #140, #80 (closed) and #79