fix(astrolabe): Address reviewer feedback for hybrid mode

Addresses code review feedback:

Personal.php:
- Consolidate template variables to use camelCase consistently
- Remove duplicate snake_case variables (auth_mode, supports_app_passwords)
- Add oauthUrl to standard OAuth mode parameters (fixes fallback issue)
- Add requesttoken for CSRF protection

personal.php (template):
- Use null coalescing for safe variable access
- Reuse computed $isHybridMode variable instead of duplicate check
- Remove complex fallback URL logic (oauthUrl now always provided)

IdpTokenRefresher.php:
- Use Nextcloud's overwrite.cli.url config when available
- Fall back to http://localhost for container deployments
- Better supports non-containerized environments

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

third_party/astrolabe/lib/Settings/Personal.php

@@ -93,23 +93,21 @@ class Personal implements ISettings {
 			// OAuth URL for Astrolabe's own OAuth controller (NOT MCP server's browser OAuth)
 			$oauthUrl = $this->urlGenerator->linkToRoute('astrolabe.oauth.initiateOAuth');
 
+			// Consolidated template parameters (camelCase convention)
 			$parameters = [
 				'userId' => $userId,
 				'serverUrl' => $this->client->getPublicServerUrl(),
 				'serverStatus' => $serverStatus,
-				'auth_mode' => $authMode,
 				'authMode' => $authMode,
-				'supports_app_passwords' => $supportsAppPasswords,
 				'supportsAppPasswords' => $supportsAppPasswords,
 				'session' => null, // No session in hybrid mode
 				'vectorSyncEnabled' => $serverStatus['vector_sync_enabled'] ?? false,
 				// OAuth token status (for Astrolabe→MCP API calls)
-				'hasToken' => $hasOAuthToken,
 				'hasOAuthToken' => $hasOAuthToken,
 				'oauthUrl' => $oauthUrl,
 				// App password status (for MCP→Nextcloud background sync)
 				'hasBackgroundAccess' => $hasAppPassword,
-				'backgroundAccessGranted' => $hasAppPassword,
+				'backgroundAccessGranted' => $hasAppPassword, // Legacy alias
 				'backgroundSyncType' => $backgroundSyncType,
 				'backgroundSyncProvisionedAt' => $backgroundSyncProvisionedAt,
 				'requesttoken' => \OCP\Util::callRegister(),
@@ -186,6 +184,9 @@ class Personal implements ISettings {
 		$backgroundSyncType = $this->tokenStorage->getBackgroundSyncType($userId);
 		$backgroundSyncProvisionedAt = $this->tokenStorage->getBackgroundSyncProvisionedAt($userId);
 
+		// OAuth URL for standard OAuth mode (in case user needs to re-authorize)
+		$oauthUrl = $this->urlGenerator->linkToRoute('astrolabe.oauth.initiateOAuth');
+
 		// Provide initial state for Vue.js frontend (if needed)
 		$this->initialState->provideInitialState('user-data', [
 			'userId' => $userId,
@@ -193,17 +194,22 @@ class Personal implements ISettings {
 			'session' => $userSession,
 		]);
 
+		// Consolidated template parameters (camelCase convention)
 		$parameters = [
 			'userId' => $userId,
+			'serverUrl' => $this->client->getPublicServerUrl(),
 			'serverStatus' => $serverStatus,
 			'session' => $userSession,
 			'vectorSyncEnabled' => $serverStatus['vector_sync_enabled'] ?? false,
-			'backgroundAccessGranted' => $userSession['background_access_granted'] ?? false,
-			'serverUrl' => $this->client->getPublicServerUrl(),
-			'hasToken' => true,
+			// OAuth status
+			'hasOAuthToken' => true,
+			'oauthUrl' => $oauthUrl,
+			// Background sync status
 			'hasBackgroundAccess' => $hasBackgroundAccess,
+			'backgroundAccessGranted' => $userSession['background_access_granted'] ?? false, // Legacy
 			'backgroundSyncType' => $backgroundSyncType,
 			'backgroundSyncProvisionedAt' => $backgroundSyncProvisionedAt,
+			'requesttoken' => \OCP\Util::callRegister(),
 		];
 
 		return new TemplateResponse(