[Feature] Apple OAuth login

[fregataa]

Summary

Implement Apple Sign In for user authentication.

Prerequisites

• [Feature] OAuth infrastructure setup #20 OAuth infrastructure setup

Scope

Setup

• Enroll in Apple Developer Program
• Configure Sign in with Apple capability
• Create Service ID
• Create and configure private key
• Set return URLs

Backend

• Add Apple OAuth config (team ID, key ID, service ID, private key)
• Implement Apple OAuth callback handler
• Verify Apple ID token (JWT)
• Handle Apple's unique user identifier
• Handle "Hide My Email" feature

Frontend

• Add "Sign in with Apple" button (with Apple brand guidelines)
• Handle Apple OAuth redirect

Environment Variables

APPLE_TEAM_ID=
APPLE_SERVICE_ID=
APPLE_KEY_ID=
APPLE_PRIVATE_KEY=
APPLE_REDIRECT_URI=

Notes

• Apple only sends user email on first authorization
• Must store email on first login
• Required for iOS apps with social login

Acceptance Criteria

• Users can sign up/login with Apple ID
• Apple account linked to user profile
• Follows Apple Human Interface Guidelines
• Handles "Hide My Email" correctly

References

• Sign in with Apple Documentation