feat: native app links for passkeys (#12580)

# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>

internal/command/project_application_oidc_model.go

@@ -14,32 +14,36 @@ import (
 type OIDCApplicationWriteModel struct {
 	eventstore.WriteModel
 
-	AppID                    string
-	AppName                  string
-	ClientID                 string
-	HashedSecret             string
-	ClientSecretString       string
-	RedirectUris             []string
-	ResponseTypes            []domain.OIDCResponseType
-	GrantTypes               []domain.OIDCGrantType
-	ApplicationType          domain.OIDCApplicationType
-	AuthMethodType           domain.OIDCAuthMethodType
-	PostLogoutRedirectUris   []string
-	OIDCVersion              domain.OIDCVersion
-	Compliance               *domain.Compliance
-	DevMode                  bool
-	AccessTokenType          domain.OIDCTokenType
-	AccessTokenRoleAssertion bool
-	IDTokenRoleAssertion     bool
-	IDTokenUserinfoAssertion bool
-	ClockSkew                time.Duration
-	State                    domain.AppState
-	AdditionalOrigins        []string
-	SkipNativeAppSuccessPage bool
-	BackChannelLogoutURI     string
-	LoginVersion             domain.LoginVersion
-	LoginBaseURI             string
-	oidc                     bool
+	AppID                         string
+	AppName                       string
+	ClientID                      string
+	HashedSecret                  string
+	ClientSecretString            string
+	RedirectUris                  []string
+	ResponseTypes                 []domain.OIDCResponseType
+	GrantTypes                    []domain.OIDCGrantType
+	ApplicationType               domain.OIDCApplicationType
+	AuthMethodType                domain.OIDCAuthMethodType
+	PostLogoutRedirectUris        []string
+	OIDCVersion                   domain.OIDCVersion
+	Compliance                    *domain.Compliance
+	DevMode                       bool
+	AccessTokenType               domain.OIDCTokenType
+	AccessTokenRoleAssertion      bool
+	IDTokenRoleAssertion          bool
+	IDTokenUserinfoAssertion      bool
+	ClockSkew                     time.Duration
+	State                         domain.AppState
+	AdditionalOrigins             []string
+	SkipNativeAppSuccessPage      bool
+	BackChannelLogoutURI          string
+	LoginVersion                  domain.LoginVersion
+	LoginBaseURI                  string
+	IOSTeamID                     string
+	IOSBundleID                   string
+	AndroidPackageName            string
+	AndroidSHA256CertFingerprints []string
+	oidc                          bool
 }
 
 func NewOIDCApplicationWriteModelWithAppID(projectID, appID, resourceOwner string) *OIDCApplicationWriteModel {
@@ -140,6 +144,10 @@ func (wm *OIDCApplicationWriteModel) Reduce() error {
 			wm.BackChannelLogoutURI = ""
 			wm.LoginVersion = domain.LoginVersionUnspecified
 			wm.LoginBaseURI = ""
+			wm.IOSTeamID = ""
+			wm.IOSBundleID = ""
+			wm.AndroidPackageName = ""
+			wm.AndroidSHA256CertFingerprints = nil
 			wm.oidc = false
 			wm.AppName = e.Name
 			wm.State = domain.AppStateActive
@@ -189,6 +197,10 @@ func (wm *OIDCApplicationWriteModel) Reduce() error {
 			wm.BackChannelLogoutURI = ""
 			wm.LoginVersion = domain.LoginVersionUnspecified
 			wm.LoginBaseURI = ""
+			wm.IOSTeamID = ""
+			wm.IOSBundleID = ""
+			wm.AndroidPackageName = ""
+			wm.AndroidSHA256CertFingerprints = nil
 			wm.oidc = false
 			wm.State = domain.AppStateRemoved
 		}
@@ -218,6 +230,10 @@ func (wm *OIDCApplicationWriteModel) appendAddOIDCEvent(e *project.OIDCConfigAdd
 	wm.BackChannelLogoutURI = e.BackChannelLogoutURI
 	wm.LoginVersion = e.LoginVersion
 	wm.LoginBaseURI = e.LoginBaseURI
+	wm.IOSTeamID = e.IOSTeamID
+	wm.IOSBundleID = e.IOSBundleID
+	wm.AndroidPackageName = e.AndroidPackageName
+	wm.AndroidSHA256CertFingerprints = e.AndroidSHA256CertFingerprints
 }
 
 func (wm *OIDCApplicationWriteModel) appendChangeOIDCEvent(e *project.OIDCConfigChangedEvent) {
@@ -275,6 +291,18 @@ func (wm *OIDCApplicationWriteModel) appendChangeOIDCEvent(e *project.OIDCConfig
 	if e.LoginBaseURI != nil {
 		wm.LoginBaseURI = *e.LoginBaseURI
 	}
+	if e.IOSTeamID != nil {
+		wm.IOSTeamID = *e.IOSTeamID
+	}
+	if e.IOSBundleID != nil {
+		wm.IOSBundleID = *e.IOSBundleID
+	}
+	if e.AndroidPackageName != nil {
+		wm.AndroidPackageName = *e.AndroidPackageName
+	}
+	if e.AndroidSHA256CertFingerprints != nil {
+		wm.AndroidSHA256CertFingerprints = *e.AndroidSHA256CertFingerprints
+	}
 }
 
 func (wm *OIDCApplicationWriteModel) Query() *eventstore.SearchQueryBuilder {
@@ -320,6 +348,10 @@ func (wm *OIDCApplicationWriteModel) NewChangedEvent(
 	backChannelLogoutURI *string,
 	loginVersion *domain.LoginVersion,
 	loginBaseURI *string,
+	iosTeamID *string,
+	iosBundleID *string,
+	androidPackageName *string,
+	androidSHA256CertFingerprints []string,
 ) (*project.OIDCConfigChangedEvent, bool, error) {
 	changes := make([]project.OIDCConfigChanges, 0)
 	var err error
@@ -378,6 +410,18 @@ func (wm *OIDCApplicationWriteModel) NewChangedEvent(
 	if loginBaseURI != nil && wm.LoginBaseURI != *loginBaseURI {
 		changes = append(changes, project.ChangeOIDCLoginBaseURI(*loginBaseURI))
 	}
+	if iosTeamID != nil && wm.IOSTeamID != *iosTeamID {
+		changes = append(changes, project.ChangeIOSTeamID(*iosTeamID))
+	}
+	if iosBundleID != nil && wm.IOSBundleID != *iosBundleID {
+		changes = append(changes, project.ChangeIOSBundleID(*iosBundleID))
+	}
+	if androidPackageName != nil && wm.AndroidPackageName != *androidPackageName {
+		changes = append(changes, project.ChangeAndroidPackageName(*androidPackageName))
+	}
+	if androidSHA256CertFingerprints != nil && !slices.Equal(wm.AndroidSHA256CertFingerprints, androidSHA256CertFingerprints) {
+		changes = append(changes, project.ChangeAndroidSHA256CertFingerprints(androidSHA256CertFingerprints))
+	}
 
 	if len(changes) == 0 {
 		return nil, false, nil