wow, i finally found the solution…
i checked the MIC with the online decoder you mentioned - and it was invalid
i copied app eui and dev eui from the join message, so only the app key could have been wrong
(but it definitely was the pre-defined value given to me by the distributor of the tabs sensor device!)
i went with my gut feeling and just tried using the given nwkskey in place of the app key - and bingo! i got a valid MIC
the distributor just mixed up the values…
now the join request got accepted by ttn and i’m seeing the first regular sensor messages
thanks a lot for you help and pointing me into the right direction to validate the MIC!