refactor(auth): drop built-in well-known MCP client list

The client registry derived display names from a hardcoded map of
"well-known" MCP clients (claude-desktop, claude-ai, continue-dev,
zed-editor, vscode-mcp). This baked a recognized-client list into the
server even though admission already requires explicit opt-in via
ALLOWED_MCP_CLIENTS (fail-closed when unset).

Mirror the management-API surface (ALLOWED_MGMT_CLIENT), which has no
built-in client list: remove the map and derive the display name
generically from the client_id. Default remains none; clients must be
added explicitly and DCR stays off unless ENABLE_DCR=true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/client_registry.py

@@ -140,15 +140,14 @@ class ClientRegistry:
             )
 
     def _get_client_name(self, client_id: str) -> str:
-        """Get human-readable name for client_id."""
-        known_names = {
-            "claude-desktop": "Claude Desktop",
-            "claude-ai": "Claude AI",
-            "continue-dev": "Continue IDE Extension",
-            "zed-editor": "Zed Editor",
-            "vscode-mcp": "VS Code MCP Extension",
-        }
-        return known_names.get(client_id, client_id.replace("-", " ").title())
+        """Derive a human-readable display name from a client_id.
+
+        There is no built-in list of "well-known" clients: every client must be
+        opted in explicitly via ``ALLOWED_MCP_CLIENTS`` (mirroring the
+        management-API ``ALLOWED_MGMT_CLIENT`` allowlist). The display name is
+        derived generically from the client_id.
+        """
+        return client_id.replace("-", " ").title()
 
     def validate_client(
         self,

tests/unit/test_client_registry.py

@@ -157,8 +157,11 @@ def test_validate_redirect_uri_localhost_wildcard(monkeypatch):
 
 
 def test_client_name_resolution(monkeypatch):
-    registry = _get_registry(monkeypatch, "claude-desktop, custom-tool")
+    # Names are derived generically from the client_id — there is no built-in
+    # "well-known" client map, so previously special-cased ids now title-case.
+    registry = _get_registry(monkeypatch, "claude-desktop, claude-ai, custom-tool")
     assert registry.get_client("claude-desktop").name == "Claude Desktop"
+    assert registry.get_client("claude-ai").name == "Claude Ai"
     assert registry.get_client("custom-tool").name == "Custom Tool"