feat: add web-based Login Flow v2 provisioning endpoint

Add /app/provision and /app/provision/status endpoints for browser-based
Login Flow v2 app password provisioning. Used by Astrolabe's "Enable
Semantic Search" to chain OAuth (bearer token) + Login Flow v2 (app
password) in a single user interaction.

The provision page initiates Login Flow v2, opens Nextcloud's login URL
in a popup, polls for completion via background task, and redirects back
to the caller's redirect_uri on success.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/app.py

@@ -73,6 +73,10 @@ from nextcloud_mcp_server.auth.oauth_routes import (
     oauth_register_proxy,
     oauth_token_endpoint,
 )
+from nextcloud_mcp_server.auth.provision_routes import (
+    provision_page,
+    provision_status,
+)
 from nextcloud_mcp_server.auth.session_backend import SessionAuthBackend
 from nextcloud_mcp_server.auth.storage import RefreshTokenStorage, get_shared_storage
 from nextcloud_mcp_server.auth.token_broker import TokenBrokerService
@@ -2317,6 +2321,11 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
             chunk_context_endpoint,
             methods=["GET"],
         ),  # /app/chunk-context
+        # Login Flow v2 web provisioning (used by Astrolabe)
+        Route("/provision", provision_page, methods=["GET"]),  # /app/provision
+        Route(
+            "/provision/status", provision_status, methods=["GET"]
+        ),  # /app/provision/status
         # Webhook management routes (admin-only)
         Route("/webhooks", webhook_management_pane, methods=["GET"]),  # /app/webhooks
         Route(