Fix cryptic decoding error when Apple rejects credentials (e.g. locked account)

[zakis5]

Why

When trying to install a different version of xcode from xcodes CLI, i got this error:

➜  code $ sudo xcodes install 26.5
Apple ID: zakishaheen@me.com
Apple ID Password:
The operation couldn’t be completed. (DecodingError.DecodingError.dataCorrupted: Data was corrupted. Debug description: The given data was not valid JSON.. Underlying error: Error Domain=NSCocoaErrorDomain Code=3840 "Unexpected character '<' around line 1, column 1." UserInfo={NSJSONSerializationErrorIndex=0, NSDebugDescription=Unexpected character '<' around line 1, column 1.})
The operation couldn’t be completed. (DecodingError.DecodingError.dataCorrupted: Data was corrupted. Debug description: The given data was not valid JSON.. Underlying error: Error Domain=NSCocoaErrorDomain Code=3840 "Unexpected character '<' around line 1, column 1." UserInfo={NSJSONSerializationErrorIndex=0, NSDebugDescription=Unexpected character '<' around line 1, column 1.})

Summary

• srpLogin decoded the sign-in response body as SignInResponse before checking the HTTP status code. When Apple rejects credentials (e.g. a locked account) it can return an HTML error page instead of JSON, so decoding threw NetworkError.decoding with Foundation's raw DecodingError text instead of a readable error. This is what xcodes install users see as:

  The operation couldn't be completed. (DecodingError.DecodingError.dataCorrupted: ... Unexpected character '<' around line 1, column 1. ...)
  

• Decoding is now best-effort; the HTTP status code drives branching regardless of whether the body parsed as JSON, and a truncated preview of the raw body is used as the error message when it doesn't parse.

Test plan

• Added testSrpLoginThrowsAccountLockedWhenAppleRejectsCredentialsWithJSON — baseline case, JSON error body still maps to AuthenticationError.accountLocked.
• Added testSrpLoginThrowsDescriptiveAccountLockedErrorWhenAppleRejectsCredentialsWithHTML — reproduces the reported bug (403 + HTML body) and asserts a readable accountLocked error instead of a raw DecodingError.
• swift test passes (35/35, 1 skipped live-network test).
• Built the xcodes CLI (XcodesOrg/xcodes) against this branch locally and ran xcodes update to confirm the real login flow still works end-to-end.