fix: update GrandSlam client info header to fix HTTP 503 error

[shahbajjamil]

Summary

Fixes the `503 Server Error: Service Temporarily Unavailable for url: https://gsa.apple.com/grandslam/GsService2\` encountered during initial authentication and device registration.
Fixes #245
Fixes #246

Root Cause

Starting in September 2026, Apple's edge firewall began rejecting any GrandSlam requests whose `X-MMe-Client-Info` header references `com.apple.dt.Xcode` (such as `<com.apple.AOSKit/282 (com.apple.dt.Xcode/3594.4.19)>`). The request is immediately rejected at the edge with an HTML `503 Service Temporarily Unavailable` response before reaching the GSA service or evaluating credentials.
This same issue was identified and resolved upstream in malmeloo/FindMy.py#271.

Changes Made

1. Updated GrandSlam Client Info Header (`pypush_gsa_icloud.py`):
   • Replaced `<com.apple.AOSKit/282 (com.apple.dt.Xcode/3594.4.19)>` with `<com.apple.AuthKit/1 (com.apple.akd/1.0)>` in `gsa_authenticated_request`.
   • Apple's edge firewall now accepts the request normally and routes it to GrandSlam.
2. Improved Error Handling (`pypush_gsa_icloud.py`):
   • Added checks for Apple's response status before reading SRP parameters (`sp`). When authentication fails (e.g. incorrect Apple ID or password), Apple returns an error status (`ec: -20101`) without `sp`. This now logs a clean, descriptive error message instead of throwing an unhandled `KeyError: 'sp'`.

---

Verification & Testing

1. Direct Request Verification:
   • Tested direct requests to `https://gsa.apple.com/grandslam/GsService2\`:
     • Old header (`Xcode`): Returns `HTTP 503 Service Temporarily Unavailable`
     • New header (`akd`): Returns `HTTP 200 OK` (valid GSA plist response)
2. Docker Container Flow:
   • Tested authentication flow inside the `macless-haystack` Docker container:
     • Initialization request succeeds with `HTTP 200`.
     • Successfully receives GrandSlam challenge and proceeds to the SMS 2FA prompt.

[dakhnod]

#245 (comment)