Ref T8498. I want to add Spaces to these, and the logic for getting Spaces right is a bit tricky, so swap these to ApplicationTransactions.
One new piece of tech: made it easier for Editors to raise DuplicateKeyException as a normal ValidationException, so callers don't have to handle this case specially.
One behavioral change: we no longer require these addresses to be at the auth.email-domains domains -- I think this wasn't quite right in the general case. It's OK to require users to have @mycompany.com addresses but add @phabricator.mycompany-infrastructure.com addresses here if you want.