feat: Add Touch ID authentication for non-GET requests

[chap]

Summary

Adds Touch ID biometric authentication to Heroku CLI for mutating operations on macOS devices with Touch ID support. Provides native macOS authentication with proper fingerprint icon dialog.

Changes

Touch ID Authentication

• Native Implementation: Uses Swift script with LocalAuthentication framework
• Selective Auth: Only POST, PUT, PATCH, DELETE require Touch ID
• Read-only Bypass: GET and HEAD requests execute without authentication
• Clean UI: Proper macOS dialog with "🔐 Touch ID authentication required" message

Implementation Details

• src/lib/biometric/: Touch ID module with API client wrapper
• scripts/touch-id-auth.swift: Swift script for native LocalAuthentication
• src/hooks/init/touch-id.ts: Hook to wrap APIClient getter
• src/hooks/prerun/touch-id.ts: Additional prerun hook support
• bin/ht: Optional command with Touch ID enabled by default

Configuration

• Enable via HEROKU_TOUCH_ID_ENABLED=true environment variable
• Disable via HEROKU_DISABLE_TOUCH_ID=true environment variable
• Use ht command for Touch ID enabled by default

Usage

Option 1: Environment Variable

export HEROKU_TOUCH_ID_ENABLED=true
heroku config:set DATABASE_URL=... -a my-app
heroku apps:create new-app

Option 2: ht Command

ht config:set KEY=value -a my-app
ht addons:create heroku-postgresql -a my-app

Testing

Enable Touch ID and run a mutating command:

HEROKU_TOUCH_ID_ENABLED=true heroku config:set TEST=yes -a your-app

You should see:

1. 🔐 Touch ID authentication required for PATCH request
2. Native macOS Touch ID dialog
3. Use fingerprint or password
4. Touch ID authenticated... ✓
5. Command executes

Debug mode:

DEBUG_TOUCH_ID=1 HEROKU_TOUCH_ID_ENABLED=true heroku config:set KEY=val -a app

Platform Support

• macOS with Touch ID: Full Touch ID support with fingerprint sensor
• macOS without Touch ID: Falls back to password authentication
• Linux/Windows: Touch ID checks skipped, proceeds normally

Security

• Uses native macOS LocalAuthentication framework
• Secure execFile implementation (prevents command injection)
• Only affects mutating operations (preserves read-only performance)
• Environment variable control for CI/CD environments

Notes

• Based on clean main branch
• ht command is optional - primary usage is via environment variable
• No changes to default heroku command behavior
• Touch ID only active when explicitly enabled