Document the storage-first launch flow

Add an explicit spec for the storage-first handoff (remoteStorage spec
section 11): launching an app passes only `#remotestorage=<address>`,
never an access token. The app then runs the application-first
(now PKCE-capable) flow itself.

Part of #254

app/controllers/services/rs_auths_controller.rb

@@ -29,6 +29,8 @@ class Services::RsAuthsController < Services::BaseController
         current_user.address
       end
 
+    # Storage-first bearer token issuance (remoteStorage spec §11): the app
+    # receives the address and runs the application-first flow itself.
     launch_url = "#{@auth.launch_url}#remotestorage=#{user_address}"
 
     redirect_to launch_url, allow_other_host: true

spec/controllers/services/rs_auths_controller_spec.rb

@@ -11,7 +11,7 @@ RSpec.describe Services::RsAuthsController, type: :controller do
     ])
   end
 
-  describe "GET /services/storage/rs_auths/:id/launch_app" do
+  describe "GET /services/storage/rs_auths/:id/launch_app (storage-first)" do
     context "when user is signed in" do
       before do
         sign_in user
@@ -32,10 +32,14 @@ RSpec.describe Services::RsAuthsController, type: :controller do
           @auth.destroy
         end
 
-        it "redirects to the given URL with the correct RS URL fragment params" do
+        it "hands the app the user address in the URL fragment" do
           launch_url = "https://app.example.com#remotestorage=#{user.address}"
           expect(response).to redirect_to(launch_url)
         end
+
+        it "does not hand over an access token" do
+          expect(response.location).not_to include("access_token")
+        end
       end
 
       context "when remoteStorage is not enabled for the user" do