replaced account data singleton with a session model

lib/api/marianumconnect/auth/auth_interceptor.dart

@@ -1,12 +1,13 @@
 import 'package:dio/dio.dart';
 
-import '../../../model/account_data.dart';
+import '../../../session/session.dart';
+import '../../../session/session_manager.dart';
 import '../queries/auth_login/auth_login.dart';
 import 'device_token_name.dart';
 import 'token_storage.dart';
 
 /// Adds the bearer token to outgoing Marianum-Connect requests and, on 401,
-/// re-logs in once with the credentials in [AccountData] before retrying.
+/// renews the token once before retrying.
 class MarianumConnectAuthInterceptor extends Interceptor {
   static const _retriedKey = 'mc_auth_retried';
 
@@ -87,25 +88,26 @@ class MarianumConnectAuthInterceptor extends Interceptor {
   }
 
   Future<bool> _performReLogin() async {
-    if (!AccountData().isPopulated()) return false;
-    final username = AccountData().getUsername();
+    final session = SessionManager().current;
+    if (session is! CredentialSession) return false;
+    final username = session.username;
     // A background engine (widget task) keeps the account it loaded. When
     // the app signed that account out, its revoked token answers 401 — a
     // re-login would mint a fresh token for it into the shared keystore.
-    if (await AccountData().readStoredUsername() != username) return false;
+    if (await SessionManager().readStoredUsername() != username) return false;
     try {
       await _loginClient.run(
         username: username,
-        password: AccountData().getPassword(),
+        password: session.password,
         tokenName: await DeviceTokenName.resolve(),
       );
     } catch (_) {
-      if (await AccountData().readStoredUsername() == username) {
+      if (await SessionManager().readStoredUsername() == username) {
         await _tokenStorage.clear();
       }
       return false;
     }
-    final stored = await AccountData().readStoredUsername();
+    final stored = await SessionManager().readStoredUsername();
     if (stored == username) return true;
     // Signed out during the login: drop the orphaned token, unless another
     // account already stored its own.

lib/api/marianumconnect/auth/session_validator.dart

@@ -1,39 +1,43 @@
 import 'dart:developer';
 
-import '../../../model/account_data.dart';
+import '../../../session/session.dart';
+import '../../../session/session_lifecycle.dart';
+import '../../../session/session_manager.dart';
 import '../../errors/auth_exception.dart';
-import '../queries/auth_logout/auth_logout.dart';
 import '../queries/auth_verify/auth_verify.dart';
-import 'token_storage.dart';
 
-/// Background credential probe — a server-side password rotation forces a
-/// re-login on the next cold start even when the bearer token would still
-/// be accepted.
+/// Credential probe. A server-side password rotation forces a re-login on the
+/// next cold start even when the bearer token would still be accepted.
 class SessionValidator {
   static Future<void> probeStored({
     required Future<void> Function() onInvalidated,
   }) async {
-    if (!AccountData().isPopulated()) return;
-    // AuthVerify uses its own dio (bypassing the demo interceptor), so a demo
-    // session must be skipped here or its missing token would 401 into a logout.
-    if (AccountData().isDemo) return;
-    final username = AccountData().getUsername();
-    final password = AccountData().getPassword();
-    final epoch = AccountData().sessionEpoch;
+    final session = SessionManager().current;
+    // The probes use their own dio (bypassing the demo interceptor), so a demo
+    // session must be skipped or its missing token would 401 into a logout.
+    if (session == null || session.isDemo) return;
+    final epoch = SessionManager().sessionEpoch;
     try {
-      await AuthVerify().run(username: username, password: password);
+      switch (session) {
+        case CredentialSession(:final username, :final password):
+          await AuthVerify().run(username: username, password: password);
+      }
     } on AuthException catch (e) {
       if (e.statusCode != 401) return;
       // The probed account already signed out; the 401 must not sign out
       // whoever logged in meanwhile.
-      if (!AccountData().isCurrentSession(epoch)) return;
-      log('MC: stored credentials rejected — forcing re-login');
-      await AuthLogout().run();
-      await const MarianumConnectTokenStorage().clear();
-      await AccountData().removeData();
+      if (!SessionManager().isCurrentSession(epoch)) return;
+      log('MC: stored session rejected — forcing re-login');
+      await SessionLifecycle.signOut(
+        notice: switch (session) {
+          CredentialSession() =>
+            'Deine Zugangsdaten wurden vom Server abgelehnt. Vermutlich '
+                'wurde dein Passwort geändert. Bitte melde dich erneut an.',
+        },
+      );
       await onInvalidated();
     } catch (e) {
-      log('MC: background credential check failed (transient): $e');
+      log('MC: background session check failed (transient): $e');
     }
   }
 }

lib/api/marianumconnect/auth/token_storage.dart

@@ -1,5 +1,8 @@
+import 'package:dio/dio.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 
+import '../../errors/auth_exception.dart';
+
 /// `first_unlock` accessibility so the token can be read during background
 /// requests (telemetry heartbeat, push-triggered syncs) after the first device
 /// unlock following a reboot. The keychain default (`whenUnlocked`) throws
@@ -9,7 +12,7 @@ const IOSOptions _mcIosOptions = IOSOptions(
 );
 
 /// Persists the Marianum-Connect bearer token in the platform keystore. Kept
-/// separate from `AccountData` because the username/password live on (Nextcloud
+/// separate from `SessionManager` because the username/password live on (Nextcloud
 /// + MHSL still need them) while the MC token is short-lived and per-endpoint.
 class MarianumConnectTokenStorage {
   static const _tokenKey = 'mc_bearer_token';
@@ -24,6 +27,18 @@ class MarianumConnectTokenStorage {
 
   Future<String?> readToken() => _storage.read(key: _tokenKey);
 
+  /// Request options carrying the stored token, for probes that bypass the
+  /// auth interceptor. Throws [AuthException] when no token is stored.
+  Future<Options> requireBearerOptions(String caller) async {
+    final token = await readToken();
+    if (token == null || token.isEmpty) {
+      throw AuthException.unauthorized(
+        technicalDetails: '$caller: no bearer token in storage',
+      );
+    }
+    return Options(headers: {'Authorization': 'Bearer $token'});
+  }
+
   Future<String?> readTokenId() => _storage.read(key: _tokenIdKey);
 
   Future<DateTime?> readExpiresAt() async {