simplify: dedupe boilerplate and remove dead code across all layers

lib/api/marianumconnect/marianumconnect_api.dart

@@ -10,11 +10,25 @@ import 'auth/auth_interceptor.dart';
 class MarianumConnectApi {
   static const Duration _connectTimeout = Duration(seconds: 10);
   static const Duration _receiveTimeout = Duration(seconds: 20);
+  static const Duration _plainReceiveTimeout = Duration(seconds: 15);
 
   static final Dio _instance = _build();
 
   static Dio dio() => _instance;
 
+  /// A fresh dio with the standard JSON options but no interceptors — used by
+  /// the auth queries (login/verify) that must bypass the bearer/demo
+  /// interceptors to avoid a re-auth loop.
+  static Dio plainDio() => Dio(
+    BaseOptions(
+      connectTimeout: _connectTimeout,
+      sendTimeout: _connectTimeout,
+      receiveTimeout: _plainReceiveTimeout,
+      responseType: ResponseType.json,
+      contentType: 'application/json',
+    ),
+  );
+
   static Dio _build() {
     final dio = Dio(
       BaseOptions(