To enable live Apple single sign-on:
1. Register an OAuth application in your Apple Developer Console.
2. Set the Authorized Redirect URI to:
http://pictura.exit-code.net/auth/apple/callback
3. Provide client credentials in your environment or .env file:
export APPLE_CLIENT_ID=your_client_id
export APPLE_CLIENT_SECRET=your_client_secret