Coordinate GrandSlam cooldowns and validate 2FA HTTP responses

[EdmundFu-233]

Problem

GrandSlam requests can return HTML 429/503 responses instead of property lists. Isolating connections helped in a local AltServer investigation, but subsequent sign-ins still received 429 on fresh connections. Independent retries also allowed separate authentication operations to continue sending requests during the same cooldown. The trusted-device/SMS code-delivery paths checked only the transport error, so an HTTP failure could still lead to a verification-code prompt.

Changes

• Route SRP and trusted-device/SMS authentication through one Foundation-only transport, with a separate ephemeral session for every attempt.
• Serialize requests and share the server cooldown with already queued work. Honor numeric/date Retry-After values and bound queueing plus retries by a per-request deadline.
• Retry selected transient HTTP/network failures, preserve structured Apple service errors for existing error mapping, and surface HTTP failures without including authentication payloads in diagnostics.
• Do not automatically replay SMS/code-delivery requests. Reject their HTTP failures before prompting for a code.
• Add 15 isolated XCTest cases and a macOS CI workflow. The runner compiles the unchanged production transport without crypto submodules or Apple credentials.

Validation and draft status

Tests/AuthenticationTransport/run.sh: 15 tests passed. Coverage includes malformed responses, Apple errors, retry limits, cancellation, isolated sessions, shared cooldowns, very large/date-form Retry-After, request budgets, no overlapping requests, and failed code delivery.

A universal arm64 + x86_64 Release integration build passed on macOS 27.0 / Xcode 26.6 using an isolated copy of the local AltServer PR #1770 setup. That build includes the existing local SRP build accommodation discussed in altstoreio/AltStore#1713; this PR does not resolve that separate prerequisite.

This is a Draft: the 12-second spacing, 60-second fallback cooldown and 120-second request budget are conservative local policy choices, not documented Apple limits. An earlier local prototype with an updated client identity and fresh sessions completed one installation; repeated sign-ins still encountered 429. The refactored transport in this PR has passed automated and integration-build checks, but repeated real-account installation and iOS behavior remain unverified. Maintainer input on these defaults and broader end-to-end testing are needed before release.

Related: #49 (connection isolation), #53 / #56 (response handling), and altstoreio/AltStore#1776. This draft incorporates the fresh-session approach from #49 rather than claiming that connection isolation alone resolves rate limiting.

Companion AltServer UI/client-identity change: altstoreio/AltStore#1801 (Draft).

Fork CI passed for commit 4d19ac4ea55845c43b34ab861a8b4c05a1935bbe: https://github.com/EdmundFu-233/AltSign/actions/runs/34912253105. This is fork CI; upstream checks/approval are separate.