feat(macos): sign in with Apple

[sebil]

Adds Sign in with Apple as a second sign-in option, behind a small provider abstraction so more providers can plug in later without reworking the flow, identity, or UI.

What's in here

• Provider abstraction (AuthProvider.swift): AuthProviderKind (.github/.apple) + AuthProfile, the single shape every provider returns (stable id, display name, optional avatar). No token is kept, same as before.
• Identity is provider-aware: authProvider + providerUserID replace the hard-wired githubLogin as the "signed in" signal. Existing GitHub installs migrate automatically (a stored githubLogin reads as GitHub), and the legacy field is kept in sync.
• AppModel routes both providers through one completeLogin/applyProfile. GitHub keeps its device-flow; Apple is a single async ASAuthorizationController call. The flow state is generalized (AuthFlowState), Retry re-runs the last provider.
• Apple provider (AppleSignIn.swift): native sheet, stable user id, first-authorization-only name handled by caching it per user id (Apple won't return it again). No avatar — the initials fallback covers it.
• UI: the menu shows both "Sign in with GitHub" and "Sign in with Apple"; the GitHub-specific copy is now provider-aware.
• Entitlements: Munkel.entitlements with com.apple.developer.applesignin, wired into the real-identity codesign path in make-bundle.sh.

Not done / needs a real signing setup

Sign in with Apple only works with a real Apple Developer team identity, an App ID that has the capability enabled, and (for distribution) a provisioning profile. The ad-hoc dev build can't honor the entitlement, so the Apple sheet can't complete locally — I could not click-test the Apple path end to end. GitHub sign-in is unchanged and still works on the dev build. This stays a draft until we can verify Apple on a provisioned build.

Open follow-ups worth a look before marking ready:

• App Store / HIG may want the official SignInWithAppleButton rather than a plain button.
• Decide whether to check getCredentialState on launch to react to a revoked Apple credential.

Closes #215