test: clear SonarCloud security false positives in new tests

The new-code quality gate flagged test-only mock fixtures as security issues
(new_security_rating E):
- S2068 "hard-coded password" ×2: drop the unused "app_password" value from the
  get_app_password_with_scopes mocks (the code under test only reads truthiness
  + "scopes").
- S6418 "hard-coded token": NOSONAR on the Login Flow v2 poll-token test fixture.
- S5443 "publicly writable directory": NOSONAR on the /tmp debug screenshot path
  (matches this file's existing convention).

No behaviour change; all are test fixtures, not real credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_login_flow.py

@@ -169,7 +169,7 @@ async def test_initiate_rewrites_login_url_to_public_host():
             "login": "https://nc-internal.test/login/v2/flow/tok123",
             "poll": {
                 "endpoint": "https://nc-internal.test/login/v2/poll",
-                "token": "secret-poll-token",
+                "token": "secret-poll-token",  # NOSONAR: test fixture, not a real secret
             },
         },
     )