merged develop

lib/api/marianumconnect/auth/auth_interceptor.dart

@@ -105,17 +105,29 @@ class MarianumConnectAuthInterceptor extends Interceptor {
   Future<bool> _performReLogin() async {
     final session = SessionManager().current;
     if (session is! CredentialSession) return false;
+    final username = session.username;
+    // A background engine (widget task) keeps the account it loaded. When
+    // the app signed that account out, its revoked token answers 401 — a
+    // re-login would mint a fresh token for it into the shared keystore.
+    if (await SessionManager().readStoredUsername() != username) return false;
     try {
       await _loginClient.run(
-        username: session.username,
+        username: username,
         password: session.password,
         tokenName: await DeviceTokenName.resolve(),
       );
-      return true;
     } catch (_) {
-      await _tokenStorage.clear();
+      if (await SessionManager().readStoredUsername() == username) {
+        await _tokenStorage.clear();
+      }
       return false;
     }
+    final stored = await SessionManager().readStoredUsername();
+    if (stored == username) return true;
+    // Signed out during the login: drop the orphaned token, unless another
+    // account already stored its own.
+    if (stored == null) await _tokenStorage.clear();
+    return false;
   }
 
   Future<Response<dynamic>> _retryWithFreshToken(