iOS Share Extension and Files Integration fail with 403 when using app password (2FA enabled)

When using the Nextcloud iOS app (v6.6.2.2) with a user account that has 2FA enabled and logs in using an app password, the main app works correctly, but the iOS share extension and Files integration both fail to authenticate, returning a 403 Forbidden on ocs/v2.php/cloud/users/.

Steps to Reproduce:

Enable 2FA on a Nextcloud account.

Generate an app password and log into the iOS app using that token.

Confirm session appears in "Devices & Sessions".

Attempt to upload a file via:

iOS Share sheet (Photos → Share → Nextcloud)

Files app integration

Observe failure.

Expected Behavior:

Share extension and Files integration should reuse the valid app password/session and allow upload.

Actual Behavior:

Both return 403.

Client log shows: responseValidationFailed(reason: Alamofire.AFError.ResponseValidationFailureReason.unacceptableStatusCode(code: 403)) for the OCS API.

Tested Environment:

Nextcloud iOS app: 6.6.2.2

Server: Nextcloud 31.0.4

Authentication: App password (due to 2FA)

iOS: 18.4.1

Server logs:

WebDAV upload and curl work fine with app password

/ocs/v2.php/cloud/users/ returns 403 when called from extension

Start by reproducing the 403 against ocs/v2.php/cloud/users/ with the iOS app, Share Extension, and Files integration using an app password. Compare how the main app and both extensions obtain and send the session credentials. Done means Share sheet and Files uploads authenticate successfully without 403 responses.