Apple sign-in

Read docs/product/users.md and the sign-in decision record in docs/decisions. If these users have no reason to expect Apple, say so. If I have no Apple Developer account, stop and tell me. Add Sign in with Apple for the web: the App ID, the Services ID, the signing key kept as a secret and a callback URL on the product's domain. On a hosted provider, use its Apple connection with these keys. In your own service, use a maintained library, and remember that the client secret is a JWT you sign yourself with a lifetime of at most six months, so generate it so it can never lapse unseen. Apple sends the user's name only at the first authorization, so store it then. Store the identity by subject. Check Apple's current docs on hidden addresses and how to send mail to them, and never link to an existing user by a hidden address. Test with a real Apple account, including removing the app from the account and signing in again.