feat: complete iCloud 2FA from Telegram (headless re-auth, no shell/web UI)

[epheterson]

Summary

Headless deployments can't finish iCloud's 2FA without shelling into the container. This adds an opt-in Telegram reply flow: when re-authentication is needed, reply the auth keyword to have Apple push a code to your trusted devices, then reply the 6-digit code — the session validates and trusts, and sync resumes. No console, no web UI.

Root cause it also fixes: the headless path waited for a code it never requested — it never called trigger_2fa_push_notification, so no code was ever pushed. This wires up the trigger.

Config (opt-in, off by default)

app:
  telegram:
    bot_token: <your bot token>
    chat_id: <your chat id>
    listen: true          # poll Telegram for replies during a 2FA wait
    auth_keyword: auth     # reply word that triggers the push (default "auth")

Details

• config_parser: app.telegram.listen + auth_keyword.
• notify: poll_telegram_for_text; the reply prompt is routed through notify.send, so it inherits the existing 24h throttle and other channels (email/Discord/Pushover) still get the standard alert.
• sync: threads the live api into the 2FA handler and polls for the keyword/code.
• Codes tolerate spaces/dashes (123 456). Docs note 1:1 chat (group privacy mode) + a per-container bot token for multi-container setups.
• Requires icloudpy==0.9.0 for trigger_2fa_push_notification. As a bonus, that bump also fixes the documented docker exec ... icloud --username CLI flow, which now pushes a code via icloudpy's cmdline.

Testing

New tests/test_telegram_2fa.py covers the poller, config getters, notify routing, and the wait loop. Verified end-to-end against real Apple + Telegram (push triggered, code validated, session trusted).

---

Happy to split the pure trigger bug-fix (the missing trigger_2fa_push_notification call + icloudpy bump) from the Telegram convenience layer into two PRs if you'd prefer — just say the word.

[mandarons]

Happy to split the pure trigger bug-fix (the missing trigger_2fa_push_notification call + icloudpy bump) from the Telegram convenience layer into two PRs if you'd prefer — just say the word.

yes - @epheterson please split this PR as Telegram flow is optional.

[epheterson]

No problem, put up a PR with just the bump needed to get 2FA working and will rebase the telegram PR on top. Glad this 2FA issue is finally unblocked!

[epheterson]

Split delivered in #486 — the mechanism-agnostic core fix (trigger_2fa_push_notification wired into _handle_2fa_required, once per re-auth episode), already green and with no new config.

Once #486 lands I'll rebase this PR on top so the diff here narrows to just the Telegram convenience layer (the reply-driven re-auth). Holding the rebase until then so it reconciles against the final shape of #486 rather than a moving target.