refactor: prune dead pre-LOGIN_FLOW config/runtime branches

Two small post-merge cleanups deferred from PR #787 (ADR-022 follow-up).
Both were explicitly noted in the reviewer's "acknowledged deferred items"
list.

1. config.py: drop `enable_multi_user_basic_auth` and `enable_login_flow`
   from the dynaconf `_DEFAULTS` dict. They were removed from `_field_map`
   in PR #787, so `get_settings()` never read them anyway, but their
   presence in `_DEFAULTS` was visually misleading — readers might think
   they could be set via TOML when in fact `Settings.__post_init__`
   derives them from `MCP_DEPLOYMENT_MODE`. Replaced with a NOTE comment
   pointing at the canonical derivation site.

2. app.py: the lifespan code had
   `use_basic_auth = not oauth_enabled or settings.enable_login_flow`,
   which became always-True once PR #787 enforced
   `oauth_enabled ↔ enable_login_flow` via __post_init__. Hard-coded to
   `True` with a comment explaining the invariant and pointing at the
   separate follow-up that will prune the now-unreachable
   `use_basic_auth=False` code paths in `vector/oauth_sync.py` (which
   includes deleting the `use_basic_auth` parameter from
   `user_manager_task` / `oauth_processor_task` and the OAuth-token-refresh
   branch in `get_user_client`). Kept the variable name and the call-site
   conditionals as-is for now so that follow-up is a clean mechanical
   diff.

No runtime behaviour change: `use_basic_auth` already evaluated to True
in every supported mode after PR #787, and the `_DEFAULTS` entries were
already shadowed by `__post_init__`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/app.py

@@ -1789,10 +1789,19 @@ def get_app(transport: str = "streamable-http", enabled_apps: list[str] | None =
                         )
                         break
 
-                # Determine authentication mode for background sync
+                # Background sync always uses app passwords post-ADR-022:
-                # Login Flow v2 and multi-user BasicAuth: use app passwords
+                # `oauth_enabled` now implies `enable_login_flow` (single
-                # OAuth mode (without Login Flow): use OAuth refresh tokens
+                # source of truth is `MCP_DEPLOYMENT_MODE`), so the old
-                use_basic_auth = not oauth_enabled or settings.enable_login_flow
+                # `not oauth_enabled or settings.enable_login_flow` was always
+                # True. The OAuth-refresh code paths in
+                # `vector/oauth_sync.py` (gated on `use_basic_auth=False`)
+                # are now unreachable; pruning them — and dropping the
+                # `use_basic_auth` parameter from `user_manager_task` /
+                # `oauth_processor_task` — is tracked as a separate
+                # follow-up. Keep the variable name + the conditional
+                # wiring at the call sites for now so the parallel-prune
+                # PR is a clean mechanical diff.
+                use_basic_auth = True
 
                 # Start background tasks using anyio TaskGroup
                 async with anyio.create_task_group() as tg:

nextcloud_mcp_server/config.py

@@ -43,8 +43,9 @@ _DEFAULTS: dict[str, Any] = {
     "userinfo_uri": None,
     "oidc_resource_server_id": None,
     # Mode flags
-    "enable_multi_user_basic_auth": False,
+    # NOTE: `enable_multi_user_basic_auth` and `enable_login_flow` are
-    "enable_login_flow": False,
+    # intentionally absent — they are derived from MCP_DEPLOYMENT_MODE in
+    # Settings.__post_init__ (ADR-022) and not read from the dynaconf store.
     "enable_semantic_search": False,
     "enable_background_operations": False,
     "vector_sync_enabled": False,