ci: add keyless Firebase authentication via GitHub OIDC

.github/workflows/flutter-ci.yml

@@ -5,10 +5,12 @@ on:
     paths:
       - "flutter-app/**"
       - ".github/workflows/flutter-ci.yml"
+
   push:
     branches:
       - main
       - "chore/**"
+      - "feat/**"
     paths:
       - "flutter-app/**"
       - ".github/workflows/flutter-ci.yml"
@@ -20,20 +22,13 @@ jobs:
   analyze-and-test:
     runs-on: ubuntu-latest
 
-    # DB serves German local times, and a few parser tests assert the local
-    # wall-clock hour of a "+02:00" fixture (e.g. 00:00 local). On a UTC runner
-    # DateTime.toLocal() shifts that to 22:00 the day before, so the tests fail
-    # only in CI. Pin the runner to Europe/Berlin so it matches the dev machines.
     env:
       TZ: Europe/Berlin
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      # The SDK version comes from pubspec.yaml (`environment: flutter:`), the
-      # same line IzzyOnDroid's reproducible-build script parses. Pinning it a
-      # second time here would let CI drift away from the release toolchain.
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -56,3 +51,23 @@ jobs:
       - name: Test
         working-directory: flutter-app
         run: flutter test
+
+      - name: Build APK
+        working-directory: flutter-app
+        run: flutter build apk --release
+
+  authenticate-google:
+    if: github.event_name == 'push'
+    needs: analyze-and-test
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: "projects/658602031061/locations/global/workloadIdentityPools/github-actions/providers/github-actions"
+          service_account: "github-actions-firebase@besser-bahn.iam.gserviceaccount.com"

flutter-app/lib/core/constants.dart

@@ -146,7 +146,8 @@ class AppConstants {
   /// stay a plain const instead of pulling in `package_info_plus`: it is baked
   /// in at compile time, needs no plugin channel (so it also works in tests and
   /// on desktop), yet cannot silently go stale. It had gone stale before — it
-  /// read 2.0.0 while pubspec was already at 2.1.0 (#34).
+  /// read 2.0.0 while pubspec was already at
+
   static const appVersion = '2.4.1';
 
   /// Honest, identifying User-Agent for APIs that require one.

flutter-app/lib/core/network/network_error.dart

@@ -0,0 +1,27 @@
+enum NetworkErrorType {
+  timeout,
+  rateLimited,
+  unavailable,
+  badResponse,
+  unknown,
+}
+
+class NetworkError implements Exception {
+  final NetworkErrorType type;
+  final String message;
+  final int? statusCode;
+  final Object? cause;
+
+  const NetworkError({
+    required this.type,
+    required this.message,
+    this.statusCode,
+    this.cause,
+  });
+
+  @override
+  String toString() {
+    final status = statusCode != null ? ' (HTTP $statusCode)' : '';
+    return 'NetworkError.${type.name}$status: $message';
+  }
+}

flutter-app/lib/core/network/network_policy.dart

@@ -0,0 +1,27 @@
+class NetworkPolicy {
+  final Duration timeout;
+  final int maxRetries;
+  final Duration initialBackoff;
+
+  const NetworkPolicy({
+    required this.timeout,
+    required this.maxRetries,
+    required this.initialBackoff,
+  });
+
+  Duration backoffForAttempt(int attempt) {
+    return initialBackoff * (1 << attempt);
+  }
+
+  static const standard = NetworkPolicy(
+    timeout: Duration(seconds: 15),
+    maxRetries: 2,
+    initialBackoff: Duration(milliseconds: 500),
+  );
+
+  static const critical = NetworkPolicy(
+    timeout: Duration(seconds: 20),
+    maxRetries: 3,
+    initialBackoff: Duration(milliseconds: 750),
+  );
+}

flutter-app/lib/screens/settings/settings_screen.dart

@@ -1,18 +1,17 @@
+import 'package:file_picker/file_picker.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
-import 'package:url_launcher/url_launcher.dart';
-
-import 'package:file_picker/file_picker.dart';
 import 'package:share_plus/share_plus.dart';
+import 'package:url_launcher/url_launcher.dart';
 
 import '../../core/backup.dart';
 import '../../core/constants.dart';
 import '../../core/offline_package.dart';
 import '../../models/reisende.dart';
 import '../../models/split_ticket.dart';
-import '../../models/transfer_profile.dart';
 import '../../models/traewelling_models.dart';
+import '../../models/transfer_profile.dart';
 import '../../providers/offline_package_provider.dart';
 import '../../providers/service_providers.dart';
 import '../../providers/settings_provider.dart';
@@ -799,6 +798,7 @@ Future<void> _createBackup(BuildContext context) async {
 Future<void> _restoreBackup(BuildContext context) async {
   final file = await FilePicker.pickFile();
   if (file == null || !context.mounted) return;
+
   final bytes = await file.readAsBytes();
   if (!context.mounted) return;