feat: integrate token exchange into MCP server application

Wire up RFC 8693 token exchange throughout the MCP server to support
stateless per-request token conversion for external IdP scenarios.

Changes:

Authentication Flow:
- Add exchange_token_for_audience() for pure RFC 8693 exchange
- Update context_helper to use stateless token exchange
- Remove fallback to standard OAuth on exchange failure
- Make storage initialization lazy (only for delegation, not MCP tools)

Application Configuration:
- Add ENABLE_TOKEN_EXCHANGE environment variable support
- Skip provisioning tools when token exchange enabled
- Pass mcp_client_id to token broker for proper validation
- Update docker-compose.yml with token exchange config

Token Exchange Service:
- Add TOKEN_EXCHANGE_GRANT constant
- Implement exchange_token_for_audience() method
- Support both "mcp-server" and client_id audiences
- Lazy storage initialization for delegation scenarios
- Enhanced error handling and logging

Progressive Token Verifier:
- Add mcp_client_id parameter for external IdP validation
- Accept both "mcp-server" and configured client_id
- Support external IdP token verification

Key Behavior Changes:
- When ENABLE_TOKEN_EXCHANGE=true: Each MCP tool call triggers
  stateless token exchange (client token → Nextcloud token)
- When ENABLE_TOKEN_EXCHANGE=false: Uses pass-through mode
  (validates Flow 1 token and passes to Nextcloud)
- No provisioning tools registered in exchange mode
- No refresh tokens needed for request-time operations

This completes the token exchange implementation. The MCP server now
supports both pass-through (default) and exchange (opt-in) modes for
federated authentication architectures.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

nextcloud_mcp_server/app.py

@@ -580,6 +580,7 @@ async def setup_oauth_config():
         oidc_discovery_url=discovery_url,
         nextcloud_host=nextcloud_host,
         encryption_key=encryption_key,
+        mcp_client_id=client_id,
     )
 
     logger.info(
@@ -753,10 +754,16 @@ def get_app(transport: str = "sse", enabled_apps: list[str] | None = None):
                 f"Unknown app: {app_name}. Available apps: {list(available_apps.keys())}"
             )
 
-    # Register OAuth provisioning tools (Progressive Consent always enabled in OAuth mode)
-    if oauth_enabled:
+    # Register OAuth provisioning tools (only when offline access/Progressive Consent is used)
+    # With token exchange enabled (external IdP), provisioning is not needed for MCP operations
+    enable_token_exchange = (
+        os.getenv("ENABLE_TOKEN_EXCHANGE", "false").lower() == "true"
+    )
+    if oauth_enabled and not enable_token_exchange:
         logger.info("Registering OAuth provisioning tools for Progressive Consent")
         register_oauth_tools(mcp)
+    elif oauth_enabled and enable_token_exchange:
+        logger.info("Skipping provisioning tools registration (token exchange enabled)")
 
     # Override list_tools to filter based on user's token scopes (OAuth mode only)
     if oauth_enabled: