Add admin-create registration + live email-verified flag

Registration now goes through POST /api/auth/register, which admin-creates the
Kratos identity (unverified email, NO auto-sent code). Kratos self-service
registration never returns the verification flow id, so the client could never
submit the user's code to the right flow; admin creation lets the client own a
single verification flow instead. Also surface the live Kratos verified flag
and fix Apple audience + team IDs.

- kratos.Client.CreateIdentity via admin API; ErrIdentityExists / ErrInvalidCredentials
- AuthService.Register + AuthHandler.Register + public POST /api/auth/register/
- CurrentUser overrides stale user_profile.verified with the live Kratos flag;
  UserRepository.MarkVerified mirrors it back
- configmap: additional_id_token_audiences allows the .dev bundle id_token
- fix Apple/APNs team id V3PF3M6B6U -> X86BR9WTLD in .env.example + dev init

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy-k3s/manifests/kratos/configmap.yaml

@@ -65,7 +65,18 @@ data:
               # capability — see operator notes in README.md §5).
               - id: apple
                 provider: apple
+                # Production bundle id. Apple issues id_tokens with
+                # `aud` = the requesting app's bundle id, so this is the
+                # primary audience Kratos verifies against.
                 client_id: com.myhoneydue.honeyDue
+                # Debug builds out of Xcode use a `.dev` bundle id (see
+                # iosApp/honeyDue.xcodeproj — Debug config). Their id_tokens
+                # therefore have `aud: com.myhoneydue.honeyDue.dev`, which
+                # the primary client_id check rejects. Whitelist the dev
+                # audience so Apple Sign In works from a non-Release Xcode
+                # build without per-build Kratos reconfiguration.
+                additional_id_token_audiences:
+                  - com.myhoneydue.honeyDue.dev
                 apple_team_id: X86BR9WTLD
                 apple_private_key_id: HQD3NCF99C
                 mapper_url: file:///etc/kratos/oidc.apple.jsonnet
@@ -195,6 +206,10 @@ data:
     // Maps Apple OIDC claims onto the honeyDue identity schema. Apple only
     // returns the name on the very first authorization and not in the ID
     // token claims, so only email is mapped here.
+    //
+    // NOTE: we intentionally do NOT carry Apple's email_verified across via
+    // verified_addresses. Product decision: every account-creation flow —
+    // including Sign in with Apple — must complete an email verification step.
     local claims = std.extVar('claims');
     {
       identity: {