Fix re-authentication in retry logic by resolving auth endpoint via Bag()

[birmacher]

The retry logic in purchase, download, get-version-metadata, and list-versions called Login() without an Endpoint when re-authenticating after a password token expiry. This caused re-auth to silently fail because the auth endpoint was empty.

Add Bag() call before Login() in all retry blocks to resolve the auth endpoint dynamically
Fall back to hardcoded auth endpoint when bag.xml omits authenticateAccount
Detect "Your password has changed." customer message as a token expiry trigger alongside failure type 2034
Increase download retry attempts to 3 to handle license-required → token-expired chain

[Copilot]

Pull request overview

Fixes App Store CLI re-authentication during retries by resolving the auth endpoint from bag.xml before calling Login(), preventing silent re-auth failures when the endpoint is empty.

Changes:

• Add a hardcoded fallback auth endpoint and make Bag() return it when authenticateAccount is missing/empty.
• Update retry re-auth flows (purchase, download, get-version-metadata, list-versions) to call Bag() and pass the resolved auth endpoint into Login().
• Treat "Your password has changed." as a password-token-expiry signal and increase download retry attempts to 3.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/appstore/constants.go	Adds a password-changed customer message constant and a fallback authenticate endpoint constant.
pkg/appstore/appstore_purchase.go	Expands token-expiry detection to include the new customer message trigger.
pkg/appstore/appstore_bag.go	Falls back to the hardcoded authenticate endpoint when bag.xml omits it.
pkg/appstore/appstore_bag_test.go	Adds coverage for the empty-authenticateAccount fallback behavior.
cmd/purchase.go	Re-auth retry now resolves auth endpoint via Bag() before Login().
cmd/list_versions.go	Re-auth retry now resolves auth endpoint via Bag() before Login().
cmd/get_version_metadata.go	Re-auth retry now resolves auth endpoint via Bag() before Login().
cmd/download.go	Re-auth retry now resolves auth endpoint via Bag() before Login(); increases retry attempts to 3.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.