Re-instate service tokens

[rfk]

We had to backout the service tokens feature over in #351. Once we stop trying to keep a local copy of the user's email address per #352, we can bring it back and ship it. For reference the backed-out commits were:

• 799f0e2: docs(service-clients): Document Service Clients, JKUs, and JWTs
• 0a0e303: feat(tokens): allow using JWT grants from Service Clients

We should be able to just cherry-pick them back, sans the db migrations which will no longer be required.

[rfk]

IIRC, the plan for closing this out is to bring back the changes, but avoid doing any cleverness with the email address. Instead we just write an empty string into the "email" column in the db. Nobody should be asking us for the email address anymore, so this should be OK. We'll revisit the "drop the email column entirely" question as a follow-up quality bug that doesn't block this milestone.