Merging users should be a reversible transaction

[jace]

Merging users currently overrides all records of one user. This process is irreversible. However, merging should be undoable, so it needs to keep a record of what changed. This may be in two tables:

1. To keep track of attempts to merge users, including unsuccessful attempts, and status across client apps
2. To record every table and row that was mutated to effect the merger, and the old and new values of changed columns. Also to record tables and rows that were dropped due to unique constraint conflicts.