fix: fall back to the sign-in page when Apple's service key endpoint returns 404 - #5

Summary

Sign-in has been failing with a 404 since 2026-09-10. Apple stopped serving
https://appstoreconnect.apple.com/olympus/v1/app/config?hostname=itunesconnect.apple.com,
which Client uses to obtain the X-Apple-Widget-Key required by every subsequent
authentication request. fetchServiceKey had no fallback, so the 404 surfaced directly
to the user before any credentials were sent.

Reported in XcodesOrg/XcodesApp#850.

Root cause

The endpoint returns a 423-byte HTML error page:

URI:      /v1/app/config
STATUS:   404
SERVLET:  org.glassfish.jersey.servlet.ServletContainer-429e7914

The rest of olympus is healthy — /olympus/v1/session still answers 401 Unauthenticated
— and every authentication endpoint (federate, signin/init, signin/complete) still
returns JSON. Only app/config is gone. Changing the hostname parameter, requesting the
same path on itunesconnect.apple.com, or trying olympus/v2/app/config (401, so it needs
a session that does not exist yet) does not help.

Fix

fetchServiceKey() still prefers the App Store Connect endpoint, so this keeps working
unchanged if Apple restores it. When that request fails, the key is read from the
widgetKey value embedded in the Developer portal sign-in page.

Verification

• signin/init accepts the extracted key and returns a hashcash challenge
  (X-Apple-HC-Bits: 10), which loadHashcash needs.
• Built the xcodes CLI against this branch, signed in with 2FA, and downloaded and
  installed Xcode 27.0 Release Candidate (27A266a) end to end.
• swift test: 17 tests, 0 failures. Two new tests cover the fallback path and that the
  existing endpoint is still preferred when it works.

Notes

fetchServiceKey() is not memoized, matching existing behaviour: both call sites already
requested itcServiceKey on every sign-in.

🤖 Generated with Claude Code