Apple Auth

Authenticate via Apple Sign-In identity_token (iOS-only flow).

Lookup priority (this order is load-bearing — see CLAUDE.md "Apple Sign-In" section + S5 in docs/STELLARA_IOS_APP_STORE_SETUP.md):

1. users.apple_sub exact match — STABLE across sign-ins; this is the only reliable identifier for "same Apple ID, second sign-in" since Apple omits email + fullName after the first authorization for a given (App ID, Apple ID) pair.

2. users.email exact match (only when the JWT carries a VERIFIED email claim — body.email is never consulted, see _verified_email_from_claims) — links Apple Sign-In to a pre-existing email/password OR Google account on the same email. Persists apple_sub on the existing row so step 1 wins on subsequent sign-ins.

3. INSERT a new user row with both email and apple_sub if neither lookup succeeded. email MUST be present here — otherwise we hit the S5 edge case (user revoked the OAuth grant on iPhone Settings, tries again, Apple returns a brand new sub with NULL email) and return 400 APPLE_NEW_SUB_NO_EMAIL so the client can show the "Delete Stellara from Apple ID settings + retry" guidance.

After the user row is resolved, opportunistically exchange authorization_code for a refresh_token (Apple /auth/token) so a future DELETE /api/users/me can revoke the OAuth grant. Failure is logged but does NOT fail this auth request — the user signs in successfully even if Apple's token endpoint is down.