fix(auth): address PR #758 round-3 final review

Seven findings from the latest review on #758, plus a regression test
catching the substance of the cache-stampede fix:

- verify_id_token: widen id_token annotation to str | None to match
  callers passing nc_token_response.get("id_token")
- extract_user_id_from_token: use JSON-RPC reserved error code -32001
  instead of -1
- _get_cached: per-URL anyio.Lock dict + meta-lock coalesces concurrent
  cache misses into a single IdP fetch (mirrors token_broker.py idiom)
- delete_browser_session: collapse SELECT+DELETE into atomic
  DELETE ... RETURNING user_id (SQLite >= 3.35)
- new test_origin_normalise.py: parametrized port/scheme/host equivalence
  cases for the CSRF Origin guard
- browser_oauth_routes: correct misleading "PR #758 finding 5" cross-
  references (finding 5 was Fernet-key hardening, not CSRF)
- ASProxySession.nonce: make required, drop spurious "legacy session"
  default; reword the in-flight `or None` comment to reflect that
  ASProxySession is purely in-memory
- new test_get_cached_coalesces_concurrent_misses: pins the
  cache-stampede protection — fires 10 concurrent _get_cached calls and
  asserts exactly one HTTP fetch

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/storage.py

@@ -1220,23 +1220,22 @@ class RefreshTokenStorage:
         if not self._initialized:
             await self.initialize()
 
-        # SELECT the row before DELETE so we can attribute the audit log
-        # entry to the right user (PR #758 round-3 nit 5).
+        # DELETE ... RETURNING (SQLite ≥ 3.35) reads ``user_id`` atomically
+        # with the delete itself, so the audit log can't race against a
+        # concurrent delete that empties the row between SELECT and DELETE
+        # (PR #758 round-3 review).
+        user_id: str | None = None
         async with aiosqlite.connect(self.db_path) as db:
             async with db.execute(
-                "SELECT user_id FROM browser_sessions WHERE session_id = ?",
+                "DELETE FROM browser_sessions WHERE session_id = ? RETURNING user_id",
                 (session_id,),
             ) as cursor:
                 row = await cursor.fetchone()
-            user_id = row[0] if row else None
-
-            cursor = await db.execute(
-                "DELETE FROM browser_sessions WHERE session_id = ?", (session_id,)
-            )
             await db.commit()
-            deleted = cursor.rowcount > 0
 
+        deleted = row is not None
         if deleted:
+            user_id = row[0]
             logger.debug("Deleted browser session %s", session_id[:8])
             if user_id:
                 await self._audit_log(