Replace three silent failures on the headless-export path with errors

[gregakespret]

Follow-up to #1, from the same review pass. #1 fixed the two findings that lived in its own diff; these three are in findmy-export-support itself.

MobileMeDelegateResponse::config is #[serde(default)] because the iosbuddy endpoint omits it — the same reason new_with_host exists as a fallback. Three places still treat its absence as impossible:

• TokenProvider::get_storage_info reaches through it with .expect("No Quota?"). An account whose delegate carries tokens but no mobileme config panics rather than returning an error. It now returns PushError::MobileMeConfigMissing, naming the key it wanted.
• KeychainClientState::new and SharedStreamsState::new return a bare None — indistinguishable at the call site from an account that genuinely has no keychain or no shared streams — and reach the URL through .as_dictionary().unwrap(). Both now go through one mme_config_url helper that logs which dataclass and key were missing.

TokenProvider::set_mme_delegate stamped SystemTime::now() whatever the delegate's real age. This is latent, not live: the only caller today logs in immediately beforehand, so the timestamp is honest. It stops being honest the moment a delegate is restored from disk — the week-long freshness window re-arms, expired tokens go out until the timer fires, and refresh_mme then needs a live PET that a restored-session process does not have, failing as a bare TokenMissing. The refresh time is now a parameter. Because it is caller-supplied, get_mme_token no longer unwraps duration_since; a timestamp in the future forces a refresh instead of panicking.

BeaconRatchet::default() produces an empty secret, and an empty secret ratchets to another empty secret — so an accessory assembled with defaulted ratchets derived keys that decrypt nothing, with no error anywhere. get_current now rejects that state with PushError::BeaconRatchetUninitialized. The derive stays: the export path builds a BeaconAccessory only to read master_record and naming, never its ratchets, and the comment on the derive says so.

Downstream: set_mme_delegate gains a second argument, so export-findmy needs set_mme_delegate(mobileme, SystemTime::now()) at src/pipeline.rs:313. The delegate there comes from a login_apple_delegates call twenty lines up, so now() is the correct value and behaviour is unchanged.

cargo check --locked --lib passes, both with default features and with --no-default-features --features remote-anisette-v3. No new warnings (215 before and after).

🤖 Generated with Claude Code

https://claude.ai/code/session_017VmSAa6yRzmHW6kK55g57w