bugfixes, better background operation robustness and platform-specific error handling

lib/api/marianumconnect/auth/token_storage.dart

@@ -1,5 +1,13 @@
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 
+/// `first_unlock` accessibility so the token can be read during background
+/// requests (telemetry heartbeat, push-triggered syncs) after the first device
+/// unlock following a reboot. The keychain default (`whenUnlocked`) throws
+/// `-25308 errSecInteractionNotAllowed` when the device is locked.
+const IOSOptions _mcIosOptions = IOSOptions(
+  accessibility: KeychainAccessibility.first_unlock,
+);
+
 /// Persists the Marianum-Connect bearer token in the platform keystore. Kept
 /// separate from `AccountData` because the username/password live on (Nextcloud
 /// + MHSL still need them) while the MC token is short-lived and per-endpoint.
@@ -11,7 +19,7 @@ class MarianumConnectTokenStorage {
   final FlutterSecureStorage _storage;
 
   const MarianumConnectTokenStorage([
-    this._storage = const FlutterSecureStorage(),
+    this._storage = const FlutterSecureStorage(iOptions: _mcIosOptions),
   ]);
 
   Future<String?> readToken() => _storage.read(key: _tokenKey);