completed iOS push notification setup: created the NotificationServiceExtension Xcode target programmatically (via xcodeproj), embedded it in Runner, and added its xcconfig base configs; fixed Automatic Signing by switching the NSE↔Runner shared keychain from an app-group to a team-prefixed access group across entitlements, Dart and Swift; fixed the analyzer break from dio 5.9.2 dropping DioExceptionType.transformTimeout

lib/api/errors/error_mapper.dart

@@ -27,7 +27,6 @@ AppException? _dioToAppException(DioException error) {
     case DioExceptionType.connectionTimeout:
     case DioExceptionType.sendTimeout:
     case DioExceptionType.receiveTimeout:
-    case DioExceptionType.transformTimeout:
       return NetworkException.timeout(technicalDetails: error.message);
     case DioExceptionType.connectionError:
       return NetworkException(technicalDetails: error.message);

lib/api/marianumconnect/errors/marianumconnect_error.dart

@@ -14,7 +14,6 @@ AppException mapMarianumConnectError(DioException error) {
     case DioExceptionType.connectionTimeout:
     case DioExceptionType.sendTimeout:
     case DioExceptionType.receiveTimeout:
-    case DioExceptionType.transformTimeout:
       return NetworkException.timeout(technicalDetails: error.message);
     case DioExceptionType.connectionError:
       return NetworkException(technicalDetails: error.message);

lib/push/push_secure_storage.dart

@@ -5,11 +5,15 @@ import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 /// the server public key and the Nextcloud app password to decrypt pushes
 /// while the app is not running.
 ///
-/// The value reuses the existing app-group id already present in the iOS
-/// project (`ios/Runner/Runner.entitlements`). Phase 3 must additionally list
-/// it under `keychain-access-groups` for both the Runner and the NSE target.
+/// A team-prefixed keychain access group (`$(AppIdentifierPrefix)eu.mhsl…push`)
+/// listed under `keychain-access-groups` in both the Runner and the NSE
+/// entitlements. The literal `MY55VF3KPG.` prefix is the team's stable
+/// AppIdentifierPrefix; Runner and NSE share the group because they sign with
+/// the same team. (App-group ids like `group.*` can't be used here because the
+/// Xcode-managed profiles only grant `<TeamID>.*` keychain groups.)
 /// On Android `groupId` is ignored, so this is a no-op there.
-const String kPushKeychainGroup = 'group.eu.mhsl.marianum.mobile.client.widget';
+const String kPushKeychainGroup =
+    'MY55VF3KPG.eu.mhsl.marianum.mobile.client.push';
 
 /// [IOSOptions] used for every push-related secure-storage entry. Uses
 /// `first_unlock` accessibility so the NSE can read the key material after the