fix: enable uvx/PyPI deployments without Docker assumptions

Two bugs made `uvx --from . nextcloud-mcp-server run` (and any pip install)
unusable outside Docker:

1. Dynaconf was configured with ignore_unknown_envvars=True and relied on
   settings.toml to declare the key schema. With no settings.toml in a wheel
   install, every env var (NEXTCLOUD_HOST, MCP_DEPLOYMENT_MODE, ...) was
   silently dropped. Moved the schema into a Python _DEFAULTS dict passed
   directly to Dynaconf, kept settings.toml as an optional external override
   (renamed to settings.toml.example, gitignored), and pointed docker-compose
   at the example file.

2. Token SQLite DB defaulted to /app/data/tokens.db in multiple places
   (auth/storage.py, migrations.py, alembic/env.py, cli.py db subcommands),
   which blew up at uvicorn startup with FileNotFoundError on non-Docker
   hosts. Replaced with a new config.get_token_db_path() helper that
   resolves TOKEN_STORAGE_DB if explicitly set, otherwise allocates a
   per-process tempfile cleaned up at interpreter exit via atexit — mirroring
   the "ephemeral by default" pattern used for QDRANT_LOCATION=:memory:.

Containers are unaffected: docker-compose services now explicitly set
TOKEN_STORAGE_DB=/app/data/tokens.db (the fourth service that was missing
this pin has been brought in line with the other three).

Verified end-to-end in an isolated /tmp venv: env-var-only startup, Alembic
migrations run against the tempfile, Application startup complete, /health/live
returns 200, tempfile deleted on SIGTERM. Unit tests (464) + ruff + ty pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -86,13 +86,17 @@ services:
       - 127.0.0.1:9090:9090
     volumes:
       - mcp-data:/app/data
-      - ./settings.toml:/app/settings.toml:ro
+      - ./settings.toml.example:/app/settings.toml:ro
     environment:
       - NEXTCLOUD_HOST=http://app:80
       - NEXTCLOUD_USERNAME=admin
       - NEXTCLOUD_PASSWORD=admin
       - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
 
+      # Pin the token DB inside the mcp-data volume so the runtime default
+      # (ephemeral tempfile) doesn't silently apply inside containers.
+      - TOKEN_STORAGE_DB=/app/data/tokens.db
+
       # Semantic search configuration (ADR-007, ADR-021)
       - ENABLE_SEMANTIC_SEARCH=true
       - VECTOR_SYNC_SCAN_INTERVAL=5
@@ -167,7 +171,7 @@ services:
       # NO admin credentials - credentials come from client Authorization header
     volumes:
       - multi-user-basic-data:/app/data
-      - ./settings.toml:/app/settings.toml:ro
+      - ./settings.toml.example:/app/settings.toml:ro
     profiles:
       - multi-user-basic
 
@@ -243,7 +247,7 @@ services:
     volumes:
       - keycloak-tokens:/app/data
       - keycloak-oauth-storage:/app/.oauth
-      - ./settings.toml:/app/settings.toml:ro
+      - ./settings.toml.example:/app/settings.toml:ro
     profiles:
       - keycloak
 
@@ -282,7 +286,7 @@ services:
     volumes:
       - login-flow-data:/app/data
       - login-flow-oauth-storage:/app/.oauth
-      - ./settings.toml:/app/settings.toml:ro
+      - ./settings.toml.example:/app/settings.toml:ro
     profiles:
       - login-flow