docs: round-4 reviewer nits

Address four small items from the latest PR #743 review:

- login-flow-v2.md Compose example: add an inline comment +
  follow-up note pointing readers at Docker secrets for
  TOKEN_ENCRYPTION_KEY (the snippet is likely to be copy-pasted
  into production).
- auth-flows.md: rename the third column in the Astrolabe → MCP
  Server diagram from "Nextcloud OIDC" to "OIDC Provider" so the
  diagram matches the multi-IdP framing in the surrounding prose.
- login-flow-v2.md OAuth Endpoints section: rewrite the
  ambiguous "token issuance still comes from the IdP" line to
  make the cryptographic separation explicit — the MCP server
  exposes /token, but tokens are signed by the IdP's key and
  validated against its JWKS; the MCP server has no signing keys
  of its own.
- README.md auth bullet: replace the jargony "OAuth-to-MCP
  supported, with app-password conversion to Nextcloud" with the
  reviewer's clearer wording: "MCP clients authenticate via
  OAuth, the server handles Nextcloud app passwords
  transparently".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/auth-flows.md

@@ -109,7 +109,7 @@ Astrolabe                     MCP Server                   Nextcloud
 #### Astrolabe → MCP Server
 
 ```
-Astrolabe                     MCP Server                   Nextcloud OIDC
+Astrolabe                     MCP Server                   OIDC Provider
     │                             │                            │
     │── OAuth Flow ──────────────▶│◀── Token from IdP ────────▶│
     │   (user initiates)          │                            │