make peruser resumable

[janl]

(via #756 (comment))

couch_peruser doesn’t handle the case of the node it being run on failing and restarting. This is less an issue, if Problem No. 1 isn’t solved yet, as in a typical cluster there are at least two more instances of this module running that could create the database.

But say we fix Problem No. 1 (as outlined in #756 (comment)) so that each user creation will only ever result in a single attempt to create the associated database. Then Now, what should happen if in between picking up the notification to create the database and doing the DB creation, the current node becomes unavailable?

The module currently opens _changes on startup and asserts all user/db creations corresponding to the _users db. That is, if there are 100k users, on startup, the module will try to create 100k databases, even if they already exist.

A solution to this would be to add per-node high-watermark _local/ docs, so we can more efficiently resume.