merged develop

lib/api/marianumconnect/auth/session_validator.dart

@@ -19,6 +19,7 @@ class SessionValidator {
     // The probes use their own dio (bypassing the demo interceptor), so a demo
     // session must be skipped or its missing token would 401 into a logout.
     if (session == null || session.isDemo) return;
+    final epoch = SessionManager().sessionEpoch;
     try {
       switch (session) {
         case CredentialSession(:final username, :final password):
@@ -28,6 +29,9 @@ class SessionValidator {
       }
     } on AuthException catch (e) {
       if (e.statusCode != 401) return;
+      // The probed account is no longer the active one; the 401 must not
+      // sign out whoever took over meanwhile.
+      if (!SessionManager().isCurrentSession(epoch)) return;
       log('MC: stored session rejected — forcing re-login');
       final next = await SessionLifecycle.signOut(
         notice: switch (session) {