test: clear SonarCloud security false positives in new tests

The new-code quality gate flagged test-only mock fixtures as security issues
(new_security_rating E):
- S2068 "hard-coded password" ×2: drop the unused "app_password" value from the
  get_app_password_with_scopes mocks (the code under test only reads truthiness
  + "scopes").
- S6418 "hard-coded token": NOSONAR on the Login Flow v2 poll-token test fixture.
- S5443 "publicly writable directory": NOSONAR on the /tmp debug screenshot path
  (matches this file's existing convention).

No behaviour change; all are test fixtures, not real credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_login_flow.py

@@ -169,7 +169,7 @@ async def test_initiate_rewrites_login_url_to_public_host():
             "login": "https://nc-internal.test/login/v2/flow/tok123",
             "poll": {
                 "endpoint": "https://nc-internal.test/login/v2/poll",
-                "token": "secret-poll-token",
+                "token": "secret-poll-token",  # NOSONAR: test fixture, not a real secret
             },
         },
     )

tests/unit/test_oauth_tools_app_password_provisioning.py

@@ -38,8 +38,11 @@ async def test_status_reports_provisioned_for_app_password_store(
     """A Login Flow v2 app password in storage => is_provisioned with the
     app_password credential type (was previously reported as not provisioned)."""
     storage = MagicMock()
+    # Only truthiness + "scopes" are read by _get_provisioning_status; omit the
+    # app_password value entirely (avoids a false-positive hard-coded-credential
+    # finding and keeps the mock to what the code under test actually uses).
     storage.get_app_password_with_scopes = AsyncMock(
-        return_value={"app_password": "tok", "scopes": ["notes.read"]}
+        return_value={"scopes": ["notes.read"]}
     )
     storage.get_refresh_token = AsyncMock(return_value=None)
     mocker.patch.object(
@@ -58,9 +61,7 @@ async def test_status_reports_provisioned_for_app_password_store(
 async def test_revoke_deletes_app_password(mocker, _no_astrolabe_settings):
     """Revoke must delete the app password from storage (not just refresh tokens)."""
     storage = MagicMock()
-    storage.get_app_password_with_scopes = AsyncMock(
-        return_value={"app_password": "tok", "scopes": None}
-    )
+    storage.get_app_password_with_scopes = AsyncMock(return_value={"scopes": None})
     storage.get_refresh_token = AsyncMock(return_value=None)
     storage.delete_app_password = AsyncMock(return_value=True)
     mocker.patch.object(