fix: address remaining PR #589 review findings

- Consolidate MCP session + login flow cleanup into _mcp_session_with_login_flow() helper,
  replacing 4 duplicated AsyncExitStack sites in app.py
- Fix get_shared_storage() race condition by using module-level anyio.Lock() init
  (reverts regression from ba59763)
- Collapse cosmetic if/else branching in scope_authorization.py
- Consolidate dual password storage paths into single store_app_password_with_scopes() call
- Mark unused request param as _ in list_supported_scopes
- Make ALL_SUPPORTED_SCOPES an immutable tuple; use list() instead of .copy()
- Add hasattr(ctx, "elicit") guard in elicitation.py, narrow except to NotImplementedError
- Add YAML comment explaining --oauth flag for mcp-login-flow service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nextcloud_mcp_server/auth/elicitation.py

@@ -49,6 +49,12 @@ async def present_login_url(
             f"Then check the box below and click OK."
         )
 
+    if not hasattr(ctx, "elicit"):
+        logger.debug(
+            "Elicitation not available (no elicit method), returning URL in message"
+        )
+        return "message_only"
+
     try:
         result = await ctx.elicit(
             message=message,
@@ -70,7 +76,7 @@ async def present_login_url(
             logger.info("User cancelled login flow")
             return "cancelled"
 
-    except (AttributeError, NotImplementedError) as e:
+    except NotImplementedError as e:
         # Elicitation not supported by this client/SDK - fall back to message
         logger.debug(
             f"Elicitation not available ({type(e).__name__}: {e}), returning URL in message"