fixed client-reported crashes in the pdf viewer, image picker and prosemirror images, mapped webdav errors to user messages and hardened keychain, cache and push stores against io failures

lib/session/session_manager.dart

@@ -8,6 +8,7 @@ import 'package:shared_preferences/shared_preferences.dart';
 
 import '../api/marianumconnect/auth/token_storage.dart';
 import '../push/push_secure_storage.dart';
+import '../storage/keychain_write.dart';
 import '../utils/exponential_backoff.dart';
 import '../utils/random_id.dart';
 import 'account_codec.dart';
@@ -165,7 +166,7 @@ class SessionManager {
       ...sessionVaultFields(session),
       ...await _tokenStorage.readAll(),
     };
-    await _secureStorage.write(
+    await _secureStorage.writeRetrying(
       key: _vaultKey(entry.id),
       value: encodeVault(fields),
     );
@@ -209,7 +210,7 @@ class SessionManager {
 
   Future<void> _saveIndex(AccountIndex index) async {
     accounts.value = index;
-    await _secureStorage.write(key: _indexKey, value: index.encode());
+    await _secureStorage.writeRetrying(key: _indexKey, value: index.encode());
   }
 
   static int _now() => DateTime.now().millisecondsSinceEpoch;
@@ -234,7 +235,10 @@ class SessionManager {
     await setAppPassword(appPassword);
     await clearAppPasswordTalk();
     _updateNextcloud((nc) => nc.copyWith(usesLoginFlow: true));
-    await _secureStorage.write(key: SessionKeys.loginFlow, value: 'true');
+    await _secureStorage.writeRetrying(
+      key: SessionKeys.loginFlow,
+      value: 'true',
+    );
   }
 
   Future<void> setAppPasswordTalk(String appPassword) async {
@@ -258,7 +262,7 @@ class SessionManager {
 
   Future<void> _writeSecret(String key, String? value) => value == null
       ? _secureStorage.delete(key: key)
-      : _secureStorage.write(key: key, value: value);
+      : _secureStorage.writeRetrying(key: key, value: value);
 
   // App passwords live in the push-shared (group-scoped) keystore so the iOS
   // Notification Service Extension can authenticate Nextcloud calls too. That
@@ -269,7 +273,7 @@ class SessionManager {
       if (value == null) {
         await pushSecureStorage.delete(key: key);
       } else {
-        await pushSecureStorage.write(key: key, value: value);
+        await pushSecureStorage.writeRetrying(key: key, value: value);
       }
     } on Object {
       // ignore — see above
@@ -362,7 +366,10 @@ class SessionManager {
           namespace: index.accounts.isEmpty ? '' : null,
           now: _now(),
         );
-        await _secureStorage.write(key: _indexKey, value: index.encode());
+        await _secureStorage.writeRetrying(
+          key: _indexKey,
+          value: index.encode(),
+        );
       }
       accounts.value = index;
       return;
@@ -385,11 +392,11 @@ class SessionManager {
     final hasSecure =
         (await _secureStorage.read(key: SessionKeys.username)) != null;
     if (!hasSecure) {
-      await _secureStorage.write(
+      await _secureStorage.writeRetrying(
         key: SessionKeys.username,
         value: legacyUsername,
       );
-      await _secureStorage.write(
+      await _secureStorage.writeRetrying(
         key: SessionKeys.password,
         value: legacyPassword,
       );
@@ -408,7 +415,7 @@ class SessionManager {
       if (value == null) continue;
       // Same account+service: the legacy item has to go before the re-add.
       await _legacySecureStorage.delete(key: field);
-      await _secureStorage.write(key: field, value: value);
+      await _secureStorage.writeRetrying(key: field, value: value);
     }
   }
 }