CloudKit Web Services Support

[meszmate]

Summary

• Add a full CloudKit Web Services client alongside the existing Apple Sign-In authentication, bumping the crate from 0.1.1 to 0.2.0
• Introduce cargo feature flags (auth, cloudkit, both on by default) so consumers can opt into only what they need
• Add a GitHub Actions CI pipeline with format, clippy, test (across OS and feature combos), and check jobs

CloudKit capabilities

The new cloudkit module provides server-to-server access to CloudKit via signed requests (ECDSA P-256 + SHA-256):

• Records — Create, update, delete, force-delete, and query records
• Zones — Create, delete, and list record zones
• Subscriptions — Create, delete, and list subscriptions
• Change tracking — Fetch zone-level and database-level changes with sync tokens
• Users — Discover current user and lookup users by email/record name
• Assets — Request upload tokens and upload asset data
• APNs tokens — Register APNs tokens for push notifications
• Query builder — Fluent API for building filtered/sorted CloudKit queries

Other changes

• Extract AppleKeyPair into a new signing module, shared between auth and CloudKit
• Upgrade all dependencies to latest versions (reqwest 0.12, jsonwebtoken 9, p256 0.13, pem 3, base64 0.22)
• Expand error types to cover CloudKit-specific errors (throttled, zone not found, conflict, quota exceeded, etc.)
• Add 1,014 lines of tests across 8 test files covering auth, signing, URL generation, CloudKit client, queries, types, and error handling
• Update README with CloudKit documentation and feature flag usage