This is a first stepping stone in avoiding bugs by having `UserId` and
`ContextId` being proper types, and not synonyms.

We also refactor things to have `AuthenticatedUser` carry the `UserId`.

This commit makes the `GET /api/v1.0/version` test more lax, and less
prone to break on version bumps.

It can be used to "bolt-on" policy checking into Servant API routes.

Tests were written with a very flat module hierarchy which made them
a bit confusing to navigate. This commit moves everything under a common
`Test.*` hierarchy.