fixed guardian login edge cases and misleading placeholders on failed loads

lib/view/login/login.dart

@@ -7,6 +7,7 @@ import '../../api/marianumconnect/marianumconnect_endpoint.dart' as mc;
 import '../../auth_link/guardian_link_listener.dart';
 import '../../auth_link/guardian_login_link.dart';
 import '../../background/widget_background_task.dart';
+import '../../session/session_lifecycle.dart';
 import '../../state/app/modules/account/bloc/account_bloc.dart';
 import '../../state/app/modules/account/bloc/account_state.dart';
 import '../../state/app/modules/settings/bloc/settings_cubit.dart';
@@ -14,6 +15,7 @@ import '../../storage/dev_tools_settings.dart';
 import '../../storage/settings.dart' as model;
 import '../../theming/light_app_theme.dart';
 import '../../utils/haptics.dart';
+import '../../widget/info_dialog.dart';
 import '../pages/settings/widgets/endpoint_picker.dart';
 import 'guardian_login_controller.dart';
 import 'login_controller.dart';
@@ -54,6 +56,16 @@ class _LoginState extends State<Login> with SingleTickerProviderStateMixin {
     });
     GuardianLinkListener.pending.addListener(_consumeGuardianLink);
     _consumeGuardianLink();
+    WidgetsBinding.instance.addPostFrameCallback((_) => _showSignOutNotice());
+  }
+
+  /// An involuntary sign-out (expired token, rotated password) otherwise just
+  /// drops the user here without a word.
+  void _showSignOutNotice() {
+    final notice = SessionLifecycle.signOutNotice.value;
+    if (notice == null || !mounted) return;
+    SessionLifecycle.signOutNotice.value = null;
+    InfoDialog.show(context, notice, title: 'Erneut anmelden');
   }
 
   /// A tapped mail link finishes the guardian login without typing the code.
@@ -65,10 +77,13 @@ class _LoginState extends State<Login> with SingleTickerProviderStateMixin {
       uri,
       apiBase: Uri.parse(mc.MarianumConnectEndpoint.current()),
     );
-    if (link == null) return;
     await _guardianRestored;
     if (!mounted) return;
     setState(() => _audience = LoginAudience.guardian);
+    if (link == null) {
+      _guardianController.rejectForeignLink();
+      return;
+    }
     final signedIn = await _guardianController.submitLink(link);
     if (signedIn && mounted) _onLoginSuccess();
   }