Fix Apple SMS 2FA verification failing with 'Invalid security code'

[Redth]

Problem

Users who receive Apple 2FA codes via SMS (rather than trusted device push) always get "Invalid security code" when verifying. Reported in #157.

Root Cause

Four interrelated bugs in the Apple 2FA flow:

1. SMS codes sent to wrong endpoint — For hsa2 accounts, CanUseTrustedDevice is always true (even with no trusted devices), so the code defaulted to the /verify/trusteddevice/securitycode endpoint instead of /verify/phone/securitycode.

2. Phone dropdown hidden for single-phone users — The verification method dropdown only showed when TrustedPhoneNumbers.Count > 1, so users with one phone number couldn't switch from "Trusted Device" to SMS.

3. RequestSmsCodeAsync never called from UI — When SMS was selected (or auto-selected), the app never called PUT /verify/phone to trigger Apple to actually send the SMS. The method existed but was unused.

4. RequestSmsCodeAsync missing session headers — Even if called, it didn't include the required X-Apple-ID-Session-Id / scnt headers, so Apple would reject the request.

Fix

• Show the verification method dropdown whenever there are any phone numbers (≥ 1, not > 1)
• Call RequestSmsCodeAsync when a phone is selected (either auto-selected on transition to 2FA step, or manually switched by user)
• Add session headers and use cached service key in RequestSmsCodeAsync

Files Changed

• src/MauiSherpa.Core/Services/AppleDownloadAuthService.cs — Fix RequestSmsCodeAsync session headers
• src/MauiSherpa/Pages/Modals/XcodeDownloadAuthModal.razor — Fix dropdown visibility, trigger SMS delivery

Fixes #157