Add an explicit spec for the storage-first handoff (remoteStorage spec section 11): launching an app passes only `#remotestorage=<address>`, never an access token. The app then runs the application-first (now PKCE-capable) flow itself. Part of #254
#service_enabled?