Write design doc for account-level pausing

[jsha]

Right now pausing operates on (account, identifier) pairs. Sometimes there's an entire account that we'd like to pause instead; we should write up how that should work.