wip: authorize combined agents service

[ahdinosaur]

closes root-systems/cobuy#266
part of root-systems/cobuy#172

[ahdinosaur]

notes:

• context agent
  • person
  • group
• create
  • if not authenticated with type: person, creating new person agent
  • if authenticated with type: group, creating group agent with auth'd agent as admin
  • always create new credential and profile, either maybe empty
• update
  • must be authenticated
  • if type: group, auth'd agent must be admin of group agent
• relationships
  • can only create or update relationships from the source perspective