chore: address review-round-4 nits — stale delenv, upgrade hint, in-sync notes

Four small follow-ups from the reviewer's latest pass:

- tests/unit/test_stdio.py:18: the single_user_env fixture used
  monkeypatch.delenv("ENABLE_MULTI_USER_BASIC_AUTH", ...). That env var
  is no longer read after the ADR-022 follow-up; switched to delenv of
  MCP_DEPLOYMENT_MODE which is the canonical mode-selection input today.
  Comment updated to match.
- config_validators.py: when detect_auth_mode rejects an invalid
  MCP_DEPLOYMENT_MODE, surface a one-line ADR-022 migration hint if the
  rejected value is exactly "oauth_single_audience" (the most common
  upgrade pain — users carrying that value over from ADR-021 .env files).
  Other invalid values get the regular "Valid values: …" message
  unchanged.
- config.py + config_validators.py: added cross-reference comments on
  both mode-resolution sites (Settings.__post_init__ and
  detect_auth_mode) noting that they each compute the canonical mode
  independently and must be kept in sync when a new mode is added.
  Surfaces the parallel-duplication intentionally so the next maintainer
  doesn't have to discover it.
- docs/ADR-021-configuration-consolidation.md:92: appended a trailing
  comment to the historical "valid values" example, marking
  oauth_single_audience and oauth_token_exchange as removed in ADR-022.
  ADR-021 stays as the historical record; the trailer points future
  readers at the current state.

No functional changes; 1009 unit tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config.py

@@ -636,6 +636,14 @@ class Settings:
                     "of truth for selecting an auth flow."
                 )
 
+        # NOTE: this block mirrors the resolution logic in
+        # `config_validators.detect_auth_mode` (which works on strings via a
+        # `mode_map`). Both call sites resolve the deployment mode
+        # independently — the canonical AuthMode enum in detect_auth_mode,
+        # and the boolean derived flags here. **Keep them in sync when
+        # adding a new mode**: a new entry must be added in both places, in
+        # addition to `mode_map` (`config_validators.py`) and any
+        # MODE_REQUIREMENTS entry.
         resolved_mode = (self.deployment_mode or "").strip().lower()
         if not resolved_mode:
             if self.nextcloud_username and self.nextcloud_password: