fix: resolve login authentication endpoint redirects and redundant bag requests

[yunusemreyazici]

This PR resolves issues with the auth login command failing due to changes in Apple's authentication backend and an inefficient retry mechanism.

1. Fixed Redundant Bag Requests during 2FA Inputs
   Problem: The AppStore.Bag() call was placed inside the retry.Do loop in cmd/auth.go. When a user was prompted for a 2FA code, the block retried and triggered a second request to https://init.itunes.apple.com/bag.xml, causing rate-limiting/timeouts (read: operation timed out).
   Fix: Moved the AppStore.Bag() retrieval outside/before the retry.Do loop so it only requests the API bag configuration once.
2. Added Trailing Slash to Native Authentication Endpoint
   Problem: The bag configuration returns https://auth.itunes.apple.com/auth/v1/native for authentication. Sending a POST directly to this URL returns a 200 OK with Content-Length: 0 because it redirects the request, stripping the POST body.
   Fix: Programmatically check the endpoint and append /fast/ (with a trailing slash) to native endpoints so it targets https://auth.itunes.apple.com/auth/v1/native/fast/. This allows Apple's servers to successfully process the credentials.
3. Adjusted Request Content-Type to match Plist Payload
   Problem: The authentication request sent plist data but used "Content-Type": "application/x-www-form-urlencoded".
   Fix: Changed the header to "Content-Type": "application/x-apple-plist" to match the actual XML/plist format of XMLPayload sent to Apple.

---

Summary by cubic

Fixes login failures by handling Apple’s native auth redirect and preventing duplicate bag requests. Login is now reliable during 2FA and avoids rate limits/timeouts.

• Bug Fixes
  • Move AppStore.Bag() outside the retry loop to stop redundant bag requests during 2FA.
  • Normalize native auth endpoint to /auth/v1/native/fast/ (ensure trailing slash) to avoid redirect that drops the POST body.
  • Set request header to Content-Type: application/x-apple-plist to match the plist payload.

^{Written for commit ee99c76. Summary will update on new commits.}

[charlie632]

just wanted to chime in and say that I applied this diff and login is working properly.