Health Probe

Validate App Attest assertion + alice lookup → maybe mint a custom token.

Validation order matches the cross-repo spec:

1. App Attest (consume nonce, verify assertion, monotonic counter).
2. fresh_sample.end_date within adaptive freshness window.
3. len(record_ids) >= 10 else insufficient_signal.
4. Rate-limit per key (5/hour).
5. Alice /apple/identity-lookup and score.

On confident we set the imperfect_user_id custom claim before minting the token so alice (and other services reading the JWT) see the resolved id immediately — mirrors /health-providers flow.

The raw body is read first so the canonical-JSON hash is computed from the parsed-but-not-Pydantic-reserialized payload sub-tree. Pydantic v2 normalizes datetimes ("...Z" → "...+00:00"), which would mismatch the assertion's expected hash from the mobile client.