feat: unify session architecture and enhance login status visibility

This commit addresses the "Login not detected" issue after completing
OAuth login via elicitation by unifying the session architecture and
adding comprehensive visibility into background session status.

## Changes

### 1. Enhanced check_logged_in with comprehensive logging (oauth_tools.py)
- Added detailed logging at each step of token lookup
- Implemented fallback strategy: first search by provisioning_client_id,
  then fall back to user_id lookup
- This allows detection of refresh tokens created via any flow
  (elicitation or browser login)
- Log messages include flow_type, provisioned_at, and provisioning_client_id
  for debugging

### 2. Unified session architecture (browser_oauth_routes.py)
- Browser login now stores provisioning_client_id=state when saving
  refresh token
- This makes browser and elicitation flows consistent - both can be
  found by the same state parameter
- Treats Flow 2 (elicitation) and browser login as the same "background
  session"

### 3. Enhanced /user/page with session status (userinfo_routes.py)
- Added comprehensive background access section showing:
  - Background Access: Granted/Not Granted (with visual indicators)
  - Flow Type: browser/flow2/hybrid
  - Provisioned At: timestamp
  - Token Audience: nextcloud/mcp
  - Scopes: detailed scope list
- Status displayed regardless of which flow created the session
  (browser login or elicitation)

### 4. Added revoke functionality (userinfo_routes.py, app.py)
- New POST endpoint: /user/revoke
- Allows users to revoke background access (delete refresh token)
- Browser session cookie remains valid for UI access
- Confirmation dialog before revocation
- Success page with auto-redirect back to /user/page
- Registered route in app.py browser_routes

## Testing
All tests pass:
- 6/6 login elicitation tests pass
- 21/21 core OAuth tests pass
- Comprehensive logging helps debug future issues

## Fixes
Resolves: "Login not detected. Please ensure you completed the login
at the provided URL before clicking OK."

The issue occurred because elicitation and browser login created
separate sessions. Now they are unified under the same architecture.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

nextcloud_mcp_server/server/oauth_tools.py

@@ -526,20 +526,63 @@ async def check_logged_in(ctx: Context, user_id: Optional[str] = None) -> str:
         )
 
         if result.action == "accept":
-            # Check if login was successful by looking for refresh token with our state
-            # The callback stores refresh_token with provisioning_client_id=state
-            # This works regardless of the user_id we started with
+            # Check if login was successful by looking for refresh token
+            # Strategy: Try multiple lookup methods to handle both flows
+            logger.info("User accepted login prompt, checking for refresh token")
+            logger.info(f"  State parameter: {state[:16]}...")
+            logger.info(f"  User ID: {user_id}")
+
+            # First, try to find token by provisioning_client_id (Flow 2 from elicitation)
             refresh_token_data = (
                 await storage.get_refresh_token_by_provisioning_client_id(state)
             )
+
             if refresh_token_data:
-                logger.info(f"Login successful for state={state[:16]}...")
-                return "yes"
-            else:
-                return (
-                    "Login not detected. Please ensure you completed the login "
-                    "at the provided URL before clicking OK."
+                logger.info("✓ Refresh token found via provisioning_client_id lookup")
+                logger.info(
+                    f"  Flow type: {refresh_token_data.get('flow_type', 'unknown')}"
                 )
+                logger.info(
+                    f"  Provisioned at: {refresh_token_data.get('provisioned_at', 'unknown')}"
+                )
+                return "yes"
+
+            # Fallback: Try to find token by user_id (browser login or any other flow)
+            logger.info(f"✗ No token found with provisioning_client_id={state[:16]}...")
+            logger.info(f"  Trying fallback lookup by user_id: {user_id}")
+
+            refresh_token_data = await storage.get_refresh_token(user_id)
+
+            if refresh_token_data:
+                logger.info("✓ Refresh token found via user_id lookup")
+                logger.info(
+                    f"  Flow type: {refresh_token_data.get('flow_type', 'unknown')}"
+                )
+                logger.info(
+                    f"  Provisioned at: {refresh_token_data.get('provisioned_at', 'unknown')}"
+                )
+                logger.info(
+                    f"  Provisioning client ID: {refresh_token_data.get('provisioning_client_id', 'NULL')}"
+                )
+                logger.info(
+                    "  Note: This token was created via browser login or different flow"
+                )
+                return "yes"
+
+            # No token found by either method
+            logger.warning(f"✗ No refresh token found for user {user_id}")
+            logger.warning(
+                f"  Checked provisioning_client_id={state[:16]}... - NOT FOUND"
+            )
+            logger.warning(f"  Checked user_id={user_id} - NOT FOUND")
+            logger.warning(
+                "  This may indicate the user completed login but token wasn't stored"
+            )
+
+            return (
+                "Login not detected. Please ensure you completed the login "
+                "at the provided URL before clicking OK."
+            )
         elif result.action == "decline":
             return "Login declined by user."
         else: