Does CloudKit JS support private encrypted records and assets when Advanced Data Protection is enabled? Our test account has ADP and iCloud.com web access on. Native CloudKit sync succeeds, but Apple’s browser sign-in reports Authentication Error before our callback. The container, environment, allowed origin and callback have been verified. A separate native-generated web token authenticates one identity request, while a known private-record lookup returns ACCESS_DENIED. Is there a supported trusted-device temporary-approval flow for third-party CloudKit JS, or another supported approach that keeps ADP enabled?