Reviewed in advance by Frank, who said "Yeah, that sounds right.":

https://chat.opentechstrategies.com/#narrow/stream/\
45-Lever-for.20Change/topic/Accounts/near/98341

Before the ansible refactor, we were copying and pasting a lot of
ansible configs.  Instead of copying and pasting the large tar balls
that went with those deployments, they all lived in a central
'thirdparty' directory.  However, that creates confusing ansible
playbooks and directory structure, and it's much simpler to have things
co-located.  This resolves that change.

This includes documenting the policy decision that shared user
accounts are allowed, and includes various other improvements and
consolidations in our documentation about user account management.

In commit 36442f04 I added the word "roles" to a section title in
order to make the section findable via a search for that word.  This
had the unintentional side effect of changing the canonical anchor
link for that section, from "https://..DESIGN.md#user-groups" to
"https://.../DESIGN.md#user-groups--roles".  But the original link is
one that we've shared with others, including with Lever for Change, so
we should try to keep it stable.  This commit restores the original
section title (and thus the original anchor link), and moves the word
"roles" into the first paragraph so we can still find it in a search.

(Reviewed and approved by Frank in real time on the phone.)

As promised in today's meeting with LFC, create a canonical place
where we will maintain documentation for the access groups.

Also updates various docs for the system as it came to be rather
than the system as we originally intended it.

The DESIGN.md came from github.com/OpenTechStrategies/torque
before we split it apart