Add Sign in with Apple authentication

- Add AppleSocialAuth model to store Apple ID linkages
- Create AppleAuthService for JWT verification with Apple's public keys
- Add AppleSignIn handler and route (POST /auth/apple-sign-in/)
- Implement account linking (links Apple ID to existing accounts by email)
- Add Redis caching for Apple public keys (24-hour TTL)
- Support private relay emails (@privaterelay.appleid.com)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/repositories/user_repo.go

@@ -11,15 +11,16 @@ import (
 )
 
 var (
-	ErrUserNotFound     = errors.New("user not found")
-	ErrUserExists       = errors.New("user already exists")
-	ErrInvalidToken     = errors.New("invalid token")
-	ErrTokenNotFound    = errors.New("token not found")
-	ErrCodeNotFound     = errors.New("code not found")
-	ErrCodeExpired      = errors.New("code expired")
-	ErrCodeUsed         = errors.New("code already used")
-	ErrTooManyAttempts  = errors.New("too many attempts")
-	ErrRateLimitExceeded = errors.New("rate limit exceeded")
+	ErrUserNotFound       = errors.New("user not found")
+	ErrUserExists         = errors.New("user already exists")
+	ErrInvalidToken       = errors.New("invalid token")
+	ErrTokenNotFound      = errors.New("token not found")
+	ErrCodeNotFound       = errors.New("code not found")
+	ErrCodeExpired        = errors.New("code expired")
+	ErrCodeUsed           = errors.New("code already used")
+	ErrTooManyAttempts    = errors.New("too many attempts")
+	ErrRateLimitExceeded  = errors.New("rate limit exceeded")
+	ErrAppleAuthNotFound  = errors.New("apple social auth not found")
 )
 
 // UserRepository handles user-related database operations
@@ -486,3 +487,27 @@ func (r *UserRepository) FindProfilesInSharedResidences(userID uint) ([]models.U
 
 	return profiles, err
 }
+
+// --- Apple Social Auth Methods ---
+
+// FindByAppleID finds an Apple social auth by Apple ID
+func (r *UserRepository) FindByAppleID(appleID string) (*models.AppleSocialAuth, error) {
+	var auth models.AppleSocialAuth
+	if err := r.db.Where("apple_id = ?", appleID).First(&auth).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrAppleAuthNotFound
+		}
+		return nil, err
+	}
+	return &auth, nil
+}
+
+// CreateAppleSocialAuth creates a new Apple social auth record
+func (r *UserRepository) CreateAppleSocialAuth(auth *models.AppleSocialAuth) error {
+	return r.db.Create(auth).Error
+}
+
+// UpdateAppleSocialAuth updates an Apple social auth record
+func (r *UserRepository) UpdateAppleSocialAuth(auth *models.AppleSocialAuth) error {
+	return r.db.Save(auth).Error
+}