test: address round-2 claude-review on #883

- pact.yml: guard `can-i-deploy` job on `env.PACT_BROKER != ''` so a secret
  rotation/fork can't break every master merge (the CLI errors on empty URL)
- pact.yml: pin install.sh to the v2.6.1 commit SHA (immune to tag force-push)
- astrolabe_client.py: `_token_cache` Optional[dict] -> `dict | None` and drop
  the now-unused `Optional` import (CLAUDE.md union syntax)
- add tests/unit/test_astrolabe_client.py: mocked unit coverage for
  get_background_sync_status field mapping (200 provisioned / 200 not-provisioned
  / 404) — the layer that would have caught the original silent app_password bug
- consumer pact test: note the 404 branch is internal defensive handling (covered
  by the unit test), not a contract obligation

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nextcloud_mcp_server/auth/astrolabe_client.py

@@ -7,7 +7,6 @@ and retrieve user app passwords for background sync operations.
 
 import logging
 import time
-from typing import Optional
 
 from ..http import nextcloud_httpx_client
 
@@ -38,7 +37,7 @@ class AstrolabeClient:
         self.nextcloud_host = nextcloud_host.rstrip("/")
         self.client_id = client_id
         self.client_secret = client_secret
-        self._token_cache: Optional[dict] = None  # {access_token, expires_at}
+        self._token_cache: dict | None = None  # {access_token, expires_at}
 
     async def get_access_token(self) -> str:
         """