bugfixes, better background operation robustness and platform-specific error handling

lib/api/marianumconnect/auth/auth_interceptor.dart

@@ -36,7 +36,15 @@ class MarianumConnectAuthInterceptor extends Interceptor {
     // Token mitschicken statt ein eigenes 401 einzufangen.
     final pending = _pendingReLogin;
     if (pending != null) await pending;
-    final token = await _tokenStorage.readToken();
+    // Reading the keystore can throw while the device is locked (iOS
+    // errSecInteractionNotAllowed on background requests). Degrade to an
+    // unauthenticated request instead of surfacing a platform error.
+    String? token;
+    try {
+      token = await _tokenStorage.readToken();
+    } catch (_) {
+      token = null;
+    }
     if (token != null && token.isNotEmpty) {
       options.headers['Authorization'] = 'Bearer $token';
     }

lib/api/marianumconnect/auth/token_storage.dart

@@ -1,5 +1,13 @@
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 
+/// `first_unlock` accessibility so the token can be read during background
+/// requests (telemetry heartbeat, push-triggered syncs) after the first device
+/// unlock following a reboot. The keychain default (`whenUnlocked`) throws
+/// `-25308 errSecInteractionNotAllowed` when the device is locked.
+const IOSOptions _mcIosOptions = IOSOptions(
+  accessibility: KeychainAccessibility.first_unlock,
+);
+
 /// Persists the Marianum-Connect bearer token in the platform keystore. Kept
 /// separate from `AccountData` because the username/password live on (Nextcloud
 /// + MHSL still need them) while the MC token is short-lived and per-endpoint.
@@ -11,7 +19,7 @@ class MarianumConnectTokenStorage {
   final FlutterSecureStorage _storage;
 
   const MarianumConnectTokenStorage([
-    this._storage = const FlutterSecureStorage(),
+    this._storage = const FlutterSecureStorage(iOptions: _mcIosOptions),
   ]);
 
   Future<String?> readToken() => _storage.read(key: _tokenKey);