fixed stale state after logout and replayed or lost share intents

lib/api/marianumconnect/auth/auth_interceptor.dart

@@ -88,17 +88,29 @@ class MarianumConnectAuthInterceptor extends Interceptor {
 
   Future<bool> _performReLogin() async {
     if (!AccountData().isPopulated()) return false;
+    final username = AccountData().getUsername();
+    // A background engine (widget task) keeps the account it loaded. When
+    // the app signed that account out, its revoked token answers 401 — a
+    // re-login would mint a fresh token for it into the shared keystore.
+    if (await AccountData().readStoredUsername() != username) return false;
     try {
       await _loginClient.run(
-        username: AccountData().getUsername(),
+        username: username,
         password: AccountData().getPassword(),
         tokenName: await DeviceTokenName.resolve(),
       );
-      return true;
     } catch (_) {
-      await _tokenStorage.clear();
+      if (await AccountData().readStoredUsername() == username) {
+        await _tokenStorage.clear();
+      }
       return false;
     }
+    final stored = await AccountData().readStoredUsername();
+    if (stored == username) return true;
+    // Signed out during the login: drop the orphaned token, unless another
+    // account already stored its own.
+    if (stored == null) await _tokenStorage.clear();
+    return false;
   }
 
   Future<Response<dynamic>> _retryWithFreshToken(

lib/api/marianumconnect/auth/session_validator.dart

@@ -19,10 +19,14 @@ class SessionValidator {
     if (AccountData().isDemo) return;
     final username = AccountData().getUsername();
     final password = AccountData().getPassword();
+    final epoch = AccountData().sessionEpoch;
     try {
       await AuthVerify().run(username: username, password: password);
     } on AuthException catch (e) {
       if (e.statusCode != 401) return;
+      // The probed account already signed out; the 401 must not sign out
+      // whoever logged in meanwhile.
+      if (!AccountData().isCurrentSession(epoch)) return;
       log('MC: stored credentials rejected — forcing re-login');
       await AuthLogout().run();
       await const MarianumConnectTokenStorage().clear();

lib/api/marianumconnect/queries/timetable_custom_events/custom_events_migration.dart

@@ -31,18 +31,23 @@ class CustomEventsMigration {
     if (DemoMode.active) return;
     if (await _isDone()) return;
 
+    final epoch = AccountData().sessionEpoch;
     try {
       final response = await GetCustomTimetableEvent(
         GetCustomTimetableEventParams(AccountData().getUserSecret()),
       ).run();
 
       for (final event in response.events) {
+        // The POST authenticates with whoever is signed in now; after a
+        // sign-out the previous account's events would land in the next one.
+        if (!AccountData().isCurrentSession(epoch)) return;
         await TimetableCustomEventsAdd().run(event);
         await RemoveCustomTimetableEvent(
           RemoveCustomTimetableEventParams(event.id),
         ).run();
       }
 
+      if (!AccountData().isCurrentSession(epoch)) return;
       await _markDone();
       log('Custom events migration: moved ${response.events.length} event(s) to Marianum-Connect.');
     } catch (e) {