chore: address review-round-5 — stale _sync_derived_flags reference + missing migration-hint test

Two findings from the reviewer's latest pass:

- config_validators.py:329: comment in the LOGIN_FLOW validation block
  still referenced `_sync_derived_flags` (removed in commit 5; derivation
  now lives in `Settings.__post_init__`). Updated the comment to point at
  the correct location so a future reader grepping for the function name
  doesn't come up empty.
- tests/unit/test_config_validators.py: added
  `test_oauth_single_audience_migration_hint` next to the existing
  `test_invalid_deployment_mode_raises_error`. The new test pins the
  ADR-022 rename-hint branch in `detect_auth_mode` by setting
  `MCP_DEPLOYMENT_MODE=oauth_single_audience` and asserting the
  ValueError mentions both the old and new mode names plus "ADR-022".
  Without this, a future refactor could drop the hint without any test
  catching it (the prior `invalid_mode` test only asserts the generic
  "Valid values:" prefix).

No functional changes; 1010 unit tests now pass (+1 from the new hint
test).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config_validators.py

@@ -325,8 +325,8 @@ def validate_configuration(settings: Settings) -> tuple[AuthMode, list[str]]:
         # ADR-022 follow-up: the un-augmented OAuth bearer pass-through (the
         # old OAUTH_SINGLE_AUDIENCE without ENABLE_LOGIN_FLOW) needed unmerged
         # Nextcloud user_oidc patches and is no longer supported. The
-        # `enable_login_flow` flag is now derived from the resolved mode by
-        # `_sync_derived_flags`, so users only configure the mode — no
+        # `enable_login_flow` flag is now derived from the resolved mode in
+        # `Settings.__post_init__`, so users only configure the mode — no
         # separate ENABLE_LOGIN_FLOW env var is needed.
 
         # If OAuth credentials not provided, DCR must be available