Sign in with Apple — hardening

Follow-up improvements to the Sign in with Apple support that shipped in v0.8.0:

• Apple sign-in is now reliable on first attempt. Fixed a cookie-handling issue where Apple's callback could fail with a missing-verifier error.
• Account deletion fully unlinks Apple. When you delete your Proposit account, any linked Apple authorization is now revoked at Apple as part of the deletion. This is required for the upcoming iOS app's App Store submission.

Internal

• Apple's OAuth client-secret JWT is now minted at server start from the raw signing key, removing the prior 5-month rotation obligation.