as some instances may want to discourage users from sharing their Matrix
access tokens.

Disabling manual double puppeting still allows automatic double
puppeting for any server configured with a login shared secret.

If both manual and automatic double puppeting are enabled for a user,
allow `login-matrix` to replace the server-managed Matrix token with
the one given by the command.

Also add the `refresh-matrix` command to fix potential issues with
automatically-managed double puppet sessions.

Notably, disallow (but don't hide) manual double puppeting commands for
users whose DP tokens are managed automatically.  This averts some edge
cases that could happen otherwise.