Changed the Courses specification: every student has a Magpie account

Internal: changed docs/specs/COURSES.md so that every student is a Magpie account. Enrolling, buying, being added or being imported finds or makes the account through GuestCheckoutService, with no sign-up form and no password; only the browser that made a new account is signed in. Students sign in with Magpie's own sign-in, see their courses on their Dashboard and in Your courses, and can use the rest of Magpie. The school's separate email-code sign-in was removed from the specification. Three new decisions are open: product news for these accounts, what a school on its own domain serves, and free enrolment while sign-up is invite-only. Nothing is built yet.