refactor: change OAuth scope separator from colon to dot for IDP compatibility

Many identity providers (AWS Cognito, Okta, Azure AD) reject or mishandle
colons in OAuth scope names. This migrates all custom scopes from
`resource:action` to `resource.action` format (e.g., `notes:read` →
`notes.read`), which is universally accepted and aligns with industry
conventions (Microsoft, Google).

Includes Alembic migration 004 for stored scope strings and ADR-024
documenting the rationale and RFC references.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/server/semantic.py

@@ -48,7 +48,7 @@ def configure_semantic_tools(mcp: FastMCP):
             openWorldHint=True,  # Queries external Nextcloud service
         ),
     )
-    @require_scopes("semantic:read")
+    @require_scopes("semantic.read")
     @instrument_tool
     async def nc_semantic_search(
         query: str,
@@ -303,7 +303,7 @@ def configure_semantic_tools(mcp: FastMCP):
             openWorldHint=False,  # Searches only indexed Nextcloud data
         ),
     )
-    @require_scopes("semantic:read")
+    @require_scopes("semantic.read")
     @instrument_tool
     async def nc_semantic_search_answer(
         query: str,
@@ -645,7 +645,7 @@ def configure_semantic_tools(mcp: FastMCP):
             openWorldHint=True,
         ),
     )
-    @require_scopes("semantic:read")
+    @require_scopes("semantic.read")
     @instrument_tool
     async def nc_get_vector_sync_status(ctx: Context) -> VectorSyncStatusResponse:
         """Get the current vector sync status.