/users package

NewErrNotWhitelisted constructs the error with the caller's realm identity captured as a string at construction time. The _ int discriminator keeps this non-crossing (a non-crossing function can't take a `realm`-named-`cur` first param, so we use the standard _ int, rlm realm shape).