fix: 2FA login always shows generic "bad credentials" error

[Copilot]

When a WebUntis server returns a generic error (e.g. "bad credentials") in response to an authenticate request that includes an OTP, the app showed the generic "Prüfe deine Daten" toast instead of the 2FA-specific "Code ungültig" error — leaving the user no indication that the OTP was the problem.

Root cause

_authenticateUntis only returned {otpInvalid: true} when the server's error message contained explicit OTP/2FA keywords ("otp", "2fa", "mfa", …). A generic "bad credentials" response fell through to return null, which _handleLogin maps to loginFailed.

Change

Simplified the invalidOtp condition in _authenticateUntis (lib/main.dart) to treat any server error as an invalid OTP when an OTP was provided:

// Before – only matches on specific keywords when OTP is present
(contains2faHint && otpCode != null && otpCode.isNotEmpty)

// After – any error while OTP is in flight = invalid OTP
(otpCode != null && otpCode.isNotEmpty)

This ensures the caller always receives {otpInvalid: true} in that path, keeping the 2FA input visible and surfacing the correct error message.

[Copilot]

Pull request overview

Adjusts WebUntis 2FA error handling so OTP-related login failures don’t fall back to the generic “check your credentials” message when the server responds with a generic error.

Changes:

• Updates _authenticateUntis to treat any JSON-RPC error as otpInvalid when an OTP was provided.
• Adds an explanatory comment describing the intended UI behavior for 2FA failures.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

invalidOtp now becomes true for any JSON-RPC error whenever a non-empty OTP was sent. This will classify unrelated server-side/auth errors (e.g., wrong username/password, invalid school/server, temporary backend failures) as “OTP invalid”, which can mislead users and mask actionable errors. Consider restricting this fallback to clearly auth-related failures (e.g., specific error codes/messages like "bad credentials") or returning a distinct flag so the UI can show a non-OTP error when appropriate.

[Copilot]

With the new (otpCode != null && otpCode.isNotEmpty) clause, the preceding string checks in invalidOtp are redundant for the OTP-present path (the expression will always be true). If the intent is “any error when OTP is provided”, this can be simplified to improve readability and avoid implying that keyword matching still matters in that branch.