implemented an E2E-encrypted Nextcloud push-v2 notification system with support for RSA decryption and signature verification; introduced an iOS Notification Service Extension and native AppDelegate handlers for Talk actions (inline reply and mark-as-read); replaced the legacy notification registration with a new lifecycle managing app passwords and secure keypair storage; added background message handling with tray synchronization and a test notification utility in the settings.

lib/view/pages/settings/sections/account_section.dart

@@ -4,6 +4,7 @@ import 'package:flutter_bloc/flutter_bloc.dart';
 import '../../../../api/marianumcloud/cloud_users/cloud_users_actions.dart';
 import '../../../../api/marianumconnect/queries/auth_logout/auth_logout.dart';
 import '../../../../model/account_data.dart';
+import '../../../../push/push_registration.dart';
 import '../../../../state/app/modules/account/bloc/account_bloc.dart';
 import '../../../../state/app/modules/account/bloc/account_state.dart';
 import '../../../../widget/app_progress_indicator.dart';
@@ -192,10 +193,12 @@ class _AccountSectionState extends State<AccountSection> {
     context.read<AccountBloc>().setStatus(AccountStatus.loggedOut);
   }
 
-  // Best-effort revoke of the MC bearer token before we wipe local credentials.
-  // The token storage itself is cleared inside AuthLogout regardless of network
-  // success, so an offline logout still gets us into a clean local state.
+  // Ordered teardown: unregister push at Nextcloud + proxy and revoke the app
+  // password (while Nextcloud credentials are still available), THEN revoke the
+  // MC bearer token, and finally wipe local credentials. Each step is
+  // best-effort so an offline logout still reaches a clean local state.
   Future<void> _performLogout() async {
+    await PushRegistration().logoutCleanup();
     await AuthLogout().run();
     await AccountData().removeData();
     _cachedDisplayName = null;