Set a brand’s own app at a sign-in provider

The app is the org’s, for every brand without its own. The app at the provider must register every one of `redirect_uris` exactly: each live brand’s own callback, on its issuer’s host. A brand made later adds its own, which the answer that makes it names. Checks the client id and secret with the provider first (a token request it refuses for the code, not the app, when it takes them), then keeps them in place of any before. Microsoft's needs Entra's `auth_time` optional claim turned on, or a fresh sign-in through it is refused. Apple takes no `client_secret`: send its Services ID as `client_id` with `team_id`, `key_id` and the `.p8` `private_key`, from which Synq signs each client secret it sends Apple. Apple delivers mail to private relay addresses only from domains registered with the app, so register the domain Synq sends your brands' email from (the domain of their sender address) under Sign in with Apple for Email Communication, or Synq's email to people who hid their address bounces. Every other provider takes `client_id` and `client_secret`. Recorded as `org.updated` (or `brand.updated`) with the client id, never the secret. 422 `connection_rejected` when the provider refuses the app; 503 when it can't be reached; at most 10 a minute per org (429). Needs `org.connections.edit`, and a plan with `auth.byo_connections` (403 `plan_feature_unavailable` otherwise, naming the plan in `required_plan`); forgetting one never does.