docs(env): mark token storage required for login_flow

Round-6 review: in env.sample.oauth-multi-user, TOKEN_ENCRYPTION_KEY and
TOKEN_STORAGE_DB sat under "OPTIONAL: SEMANTIC SEARCH", but they're required for
any login_flow deployment (per-user app passwords must be persisted). Move them
into a dedicated "REQUIRED: APP-PASSWORD STORAGE" block with a pointer to
docs/login-flow-v2.md#setup so a login_flow-without-semantic-search user copying
the template doesn't miss them.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

env.sample.oauth-multi-user

@@ -33,6 +33,13 @@ NEXTCLOUD_OIDC_CLIENT_SECRET=<your-client-secret>
 # MCP Server URL (for OAuth redirects)
 NEXTCLOUD_MCP_SERVER_URL=http://localhost:8000
 
+# ===== REQUIRED: APP-PASSWORD STORAGE =====
+# Required for login_flow — per-user Nextcloud app passwords are stored here
+# (encrypted) so they survive restarts. See docs/login-flow-v2.md#setup.
+# Generate encryption key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+TOKEN_ENCRYPTION_KEY=<your-encryption-key>
+TOKEN_STORAGE_DB=/app/data/tokens.db
+
 # ===== OPTIONAL: SEMANTIC SEARCH (Recommended) =====
 # AI-powered semantic search with automatic background operation setup
 #
@@ -58,11 +65,6 @@ OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 #AWS_REGION=us-east-1
 #BEDROCK_EMBEDDING_MODEL=amazon.titan-embed-text-v2:0
 
-# Token Storage (required for background operations - auto-enabled by semantic search)
-# Generate encryption key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-TOKEN_ENCRYPTION_KEY=<your-encryption-key>
-TOKEN_STORAGE_DB=/app/data/tokens.db
-
 # ===== OPTIONAL: DOCUMENT PROCESSING =====
 # Extract text from PDFs, images, DOCX for semantic search
 #ENABLE_DOCUMENT_PROCESSING=true