feat: native app links for passkeys (#12580)

# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>

internal/command/project_converter.go

@@ -29,32 +29,45 @@ func projectGrantWriteModelToProjectGrant(writeModel *ProjectGrantWriteModel) *d
 
 func oidcWriteModelToOIDCConfig(writeModel *OIDCApplicationWriteModel) *domain.OIDCApp {
 	return &domain.OIDCApp{
-		ObjectRoot:               writeModelToObjectRoot(writeModel.WriteModel),
-		AppID:                    writeModel.AppID,
-		AppName:                  writeModel.AppName,
-		State:                    writeModel.State,
-		ClientID:                 writeModel.ClientID,
-		RedirectUris:             writeModel.RedirectUris,
-		ResponseTypes:            writeModel.ResponseTypes,
-		GrantTypes:               writeModel.GrantTypes,
-		ApplicationType:          gu.Ptr(writeModel.ApplicationType),
-		AuthMethodType:           gu.Ptr(writeModel.AuthMethodType),
-		PostLogoutRedirectUris:   writeModel.PostLogoutRedirectUris,
-		OIDCVersion:              gu.Ptr(writeModel.OIDCVersion),
-		DevMode:                  gu.Ptr(writeModel.DevMode),
-		AccessTokenType:          gu.Ptr(writeModel.AccessTokenType),
-		AccessTokenRoleAssertion: gu.Ptr(writeModel.AccessTokenRoleAssertion),
-		IDTokenRoleAssertion:     gu.Ptr(writeModel.IDTokenRoleAssertion),
-		IDTokenUserinfoAssertion: gu.Ptr(writeModel.IDTokenUserinfoAssertion),
-		ClockSkew:                gu.Ptr(writeModel.ClockSkew),
-		AdditionalOrigins:        writeModel.AdditionalOrigins,
-		SkipNativeAppSuccessPage: gu.Ptr(writeModel.SkipNativeAppSuccessPage),
-		BackChannelLogoutURI:     gu.Ptr(writeModel.BackChannelLogoutURI),
-		LoginVersion:             gu.Ptr(writeModel.LoginVersion),
-		LoginBaseURI:             gu.Ptr(writeModel.LoginBaseURI),
+		ObjectRoot:                    writeModelToObjectRoot(writeModel.WriteModel),
+		AppID:                         writeModel.AppID,
+		AppName:                       writeModel.AppName,
+		State:                         writeModel.State,
+		ClientID:                      writeModel.ClientID,
+		RedirectUris:                  writeModel.RedirectUris,
+		ResponseTypes:                 writeModel.ResponseTypes,
+		GrantTypes:                    writeModel.GrantTypes,
+		ApplicationType:               gu.Ptr(writeModel.ApplicationType),
+		AuthMethodType:                gu.Ptr(writeModel.AuthMethodType),
+		PostLogoutRedirectUris:        writeModel.PostLogoutRedirectUris,
+		OIDCVersion:                   gu.Ptr(writeModel.OIDCVersion),
+		DevMode:                       gu.Ptr(writeModel.DevMode),
+		AccessTokenType:               gu.Ptr(writeModel.AccessTokenType),
+		AccessTokenRoleAssertion:      gu.Ptr(writeModel.AccessTokenRoleAssertion),
+		IDTokenRoleAssertion:          gu.Ptr(writeModel.IDTokenRoleAssertion),
+		IDTokenUserinfoAssertion:      gu.Ptr(writeModel.IDTokenUserinfoAssertion),
+		ClockSkew:                     gu.Ptr(writeModel.ClockSkew),
+		AdditionalOrigins:             writeModel.AdditionalOrigins,
+		SkipNativeAppSuccessPage:      gu.Ptr(writeModel.SkipNativeAppSuccessPage),
+		BackChannelLogoutURI:          gu.Ptr(writeModel.BackChannelLogoutURI),
+		LoginVersion:                  gu.Ptr(writeModel.LoginVersion),
+		LoginBaseURI:                  gu.Ptr(writeModel.LoginBaseURI),
+		IOSTeamID:                     emptyStringPtr(writeModel.IOSTeamID),
+		IOSBundleID:                   emptyStringPtr(writeModel.IOSBundleID),
+		AndroidPackageName:            emptyStringPtr(writeModel.AndroidPackageName),
+		AndroidSHA256CertFingerprints: writeModel.AndroidSHA256CertFingerprints,
 	}
 }
 
+// emptyStringPtr returns nil for empty strings so unset app-link fields stay
+// distinguishable from explicitly set values in equality checks / APIs.
+func emptyStringPtr(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return gu.Ptr(s)
+}
+
 func samlWriteModelToSAMLConfig(writeModel *SAMLApplicationWriteModel) *domain.SAMLApp {
 	return &domain.SAMLApp{
 		ObjectRoot:   writeModelToObjectRoot(writeModel.WriteModel),