Add comment to explain sync workflow

crates/cli/src/sync.rs

@@ -190,6 +190,9 @@ pub async fn config_sync(
                 if let Some(client_secret) = provider.client_secret.as_deref() {
                     Some(encrypter.encrypt_to_string(client_secret.as_bytes())?)
                 } else if let Some(mut siwa) = provider.sign_in_with_apple.clone() {
+                    // if private key file is defined and not private key (raw), we populate the private key
+                    // to hold the content of the private key file. private key (raw) takes precedence so 
+                    // both can be defined without issues
                     if siwa.private_key.is_none() {
                         if let Some(private_key_file) = siwa.private_key_file.take() {
                             let key = tokio::fs::read_to_string(private_key_file).await?;