Direct Apple backend

Direct Apple backend — contract and behavior

• The backend reimplements the protocol layers Apple's clients use and gates externally visible operations behind completed bootstrap state.
• An operator runs the bootstrap CLI once per Apple ID; the service reads persisted device, identity, push, and anisette state afterward.
• The default bootstrap mode is a dry run; live mode contacts Apple and requires explicit account and host precautions.
• Anisette rotates on its shorter cadence while device certificate and push-token state are longer-lived.