Transporter / altool sign-in fails: "Unable to authenticate" or repeated password rejection

Command-line and Transporter uploads don't accept your normal Apple ID password when two-factor authentication is on — they require an app-specific password or an App Store Connect API key. Plain passwords fail with unhelpful generic errors.