AppleWebPending
data class AppleWebPending(val authorizeUrl: String, val state: String, val rawNonce: String)(source)
A started Apple web sign-in. Hold it until the deep link comes back.
The browser round trip can outlive the process, so this is encode/decode-able: stash the string in the same Settings the app gives TokenStore and reload it in the deep-link handler. Losing it is not fatal but it costs the user the whole flow, and it means the CSRF state check cannot run on the client at all.