feat: native app links for passkeys (#12580)

# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>

internal/command/project_application_oidc_dcr_test.go

@@ -234,7 +234,10 @@ func TestCommandSide_AddDynamicOIDCClient(t *testing.T) {
 							"",
 							domain.LoginVersionUnspecified,
 							"",
-						),
+							"",
+							"",
+							"",
+							nil),
 						// The registration access token (RFC 7592 §3) is persisted in the same
 						// push as the application, so a registered client is never left
 						// unmanageable.
@@ -336,7 +339,10 @@ func TestCommandSide_AddDynamicOIDCClient(t *testing.T) {
 							"",
 							domain.LoginVersionUnspecified,
 							"",
-						),
+							"",
+							"",
+							"",
+							nil),
 						project.NewOIDCConfigRegistrationTokenChangedEvent(context.Background(),
 							&project.NewAggregate("project1", "org1").Aggregate,
 							"app1",
@@ -581,7 +587,11 @@ func TestCommandSide_UpdateDynamicOIDCClient(t *testing.T) {
 				domain.OIDCApplicationTypeWeb, domain.OIDCAuthMethodTypeNone,
 				[]string{}, false, domain.OIDCTokenTypeBearer,
 				false, false, false, 0, []string{}, false, "",
-				domain.LoginVersionUnspecified, "")),
+				domain.LoginVersionUnspecified, "",
+				"",
+				"",
+				"",
+				nil)),
 		}
 	}
 	sameMetadata := &domain.OIDCApp{