eqosys: handle Sign in with Apple server notifications (consent revoked, Apple account deleted) #3153

Apple can tell eqosys when someone stops using Sign in with Apple with us, deletes their Apple account, or turns their relay email on or off. Apple recommends handling these; App Review doesn't require it.

• Add POST /api/apple/events. Check that Apple signed the JWT (RS256, Apple's keys at https://appleid.apple.com/auth/keys, aud = our Services ID). On consent-revoked, sign the person out everywhere (sessions and refresh tokens). On account-delete, run deleteAccount.
• Register the URL with the Services ID in the Apple developer account (the owner does this, as part of MANUAL RUN: eqosys Sign in with Apple keys and App Review accounts #2898's steps).
• Test: a signed event signs the person out, and an unsigned one gets a 401.