chore: address review-round-4 nits — stale delenv, upgrade hint, in-sync notes

Four small follow-ups from the reviewer's latest pass:

- tests/unit/test_stdio.py:18: the single_user_env fixture used
  monkeypatch.delenv("ENABLE_MULTI_USER_BASIC_AUTH", ...). That env var
  is no longer read after the ADR-022 follow-up; switched to delenv of
  MCP_DEPLOYMENT_MODE which is the canonical mode-selection input today.
  Comment updated to match.
- config_validators.py: when detect_auth_mode rejects an invalid
  MCP_DEPLOYMENT_MODE, surface a one-line ADR-022 migration hint if the
  rejected value is exactly "oauth_single_audience" (the most common
  upgrade pain — users carrying that value over from ADR-021 .env files).
  Other invalid values get the regular "Valid values: …" message
  unchanged.
- config.py + config_validators.py: added cross-reference comments on
  both mode-resolution sites (Settings.__post_init__ and
  detect_auth_mode) noting that they each compute the canonical mode
  independently and must be kept in sync when a new mode is added.
  Surfaces the parallel-duplication intentionally so the next maintainer
  doesn't have to discover it.
- docs/ADR-021-configuration-consolidation.md:92: appended a trailing
  comment to the historical "valid values" example, marking
  oauth_single_audience and oauth_token_exchange as removed in ADR-022.
  ADR-021 stays as the historical record; the trailer points future
  readers at the current state.

No functional changes; 1009 unit tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ADR-021-configuration-consolidation.md

@@ -90,6 +90,7 @@ MCP_DEPLOYMENT_MODE=login_flow
 
 # Valid values: single_user_basic, multi_user_basic,
 #               oauth_single_audience, oauth_token_exchange
+#               (both OAuth values removed in ADR-022 — current value: login_flow)
 ```
 
 **Detection logic**: