docs(self-hosting): spell out that APPLE_API_KEY is a path to the .p8

The variable holds an absolute filesystem path to the App Store Connect key
file, not the key material, and @electron/notarize reads it through Node fs so
a leading ~ is not expanded — the release workflow carries a comment saying
exactly that. Listed alongside the other credentials with no explanation, it
reads like somewhere to paste the key, and notarization then fails while every
variable looks set.

Author: waleedlatif1

apps/docs/content/docs/en/platform/self-hosting/desktop.mdx

@@ -114,7 +114,9 @@ SIM_DESKTOP_DEFAULT_ORIGIN=https://sim.example.com bun run package:mac
 This bakes your origin in as the default for fresh installs, so nobody has to set the server by hand (the picker stays available in the menu). Artifacts land in `apps/desktop/release/`, named `Sim-<version>-<arch>.dmg`. Add `-c.appId=com.example.sim` if you want your own bundle identifier rather than Sim's.
 
 <Callout type="warn">
-  Signing and notarization become your responsibility with this route, and macOS quarantines anything downloaded that is not notarized. Supply your own Developer ID via `CSC_LINK` and `CSC_KEY_PASSWORD`, and App Store Connect notarization credentials via `APPLE_API_KEY`, `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, and `APPLE_TEAM_ID`.
+  Signing and notarization become your responsibility with this route, and macOS quarantines anything downloaded that is not notarized.
+
+  Supply your own Developer ID via `CSC_LINK` and `CSC_KEY_PASSWORD`. For notarization, save your App Store Connect key as a `.p8` file and point `APPLE_API_KEY` at its **absolute filesystem path** — it is a path, not the key itself, and a leading `~` is not expanded — then set `APPLE_API_KEY_ID`, `APPLE_API_ISSUER`, and `APPLE_TEAM_ID`.
 
   Use `package:mac` for this, **not** `package:share`. The share script is the "send someone a build to try" path: it passes `-c.mac.timestamp=none` to skip the per-file round trip to Apple's timestamp authority. Apple's notary service requires a secure timestamp, so a build made that way cannot be notarized however many credentials you supply.
 </Callout>