fix single profile multi login

app/src/main/java/sh/sar/basedbank/api/bml/BmlLoginFlow.kt

@@ -121,15 +121,27 @@ class BmlLoginFlow {
         twoFaResp.close()
         if (twoFaResp.code != 302) throw Exception("OTP verification failed — check your OTP seed")
 
-        // Step 5: GET /web/profile — returns list of profiles for this account
+        // Step 5: GET /web/profile — multi-profile accounts return a 200 with a profile picker;
+        // single-profile accounts skip the picker and redirect straight to /web/redirect with
+        // blaze_identity already set in the response cookies.
         val profileResp = client.newCall(
             Request.Builder().url("$BASE_URL/web/profile")
                 .header("User-Agent", WEB_USER_AGENT).build()
         ).execute()
+        val profileCode = profileResp.code
+        val profileLocation = profileResp.header("Location") ?: ""
         val profileBody = profileResp.body?.string() ?: ""
         profileResp.close()
 
-        lastProfiles = parseProfiles(profileBody)
+        lastProfiles = if (profileCode == 302) {
+            // Any 302 from GET /web/profile means the server auto-activated the sole profile
+            // and blaze_identity is already set — no profile picker shown.
+            // Use username as a stable temporary profileId (unique per login); it will be
+            // replaced by the real BML customer ID after fetchUserInfo in finishBmlLogin().
+            listOf(BmlProfile(profileId = username, name = "Personal", type = "Profile", profileType = "default", autoActivated = true))
+        } else {
+            parseProfiles(profileBody)
+        }
         return lastProfiles
     }
 
@@ -144,6 +156,13 @@ class BmlLoginFlow {
      *   [requestBusinessOtp] + [submitBusinessOtp].
      */
     fun activateProfile(profile: BmlProfile, loginTag: String): BmlActivationResult {
+        // Single-profile accounts: server already activated during login() and set blaze_identity.
+        // autoActivated=true is the sentinel for this case — skip the profile GET entirely.
+        if (profile.autoActivated) {
+            val (session, accounts) = doOAuthAndFetchAccounts(loginTag, profile.name, profile.profileId)
+            return BmlActivationResult.Success(session, accounts)
+        }
+
         val xsrf = xsrfToken()
         val reqBuilder = Request.Builder()
             .url("$BASE_URL/web/profile/${profile.profileId}")
@@ -156,8 +175,9 @@ class BmlLoginFlow {
         resp.close()
 
         return when {
-            code == 409 || (code == 302 && "/web/redirect" in location) -> {
-                // Profile activated — blaze_identity cookie set in response headers
+            code == 409 || (code == 302 && "/web/profile/2fa/business" !in location) -> {
+                // Profile activated — blaze_identity cookie set in response headers.
+                // Any 302 that isn't to the business 2FA page means success.
                 val (session, accounts) = doOAuthAndFetchAccounts(loginTag, profile.name, profile.profileId)
                 BmlActivationResult.Success(session, accounts)
             }

app/src/main/java/sh/sar/basedbank/api/bml/BmlModels.kt

@@ -11,7 +11,8 @@ data class BmlProfile(
     val profileId: String,
     val name: String,
     val type: String,           // "Profile" (personal) or "Business"
-    val profileType: String     // "default" or "business"
+    val profileType: String,    // "default" or "business"
+    val autoActivated: Boolean = false  // true for single-profile accounts where server skips the picker
 )
 
 data class BmlOtpChannel(