docs(login-flow): clarify re-auth + placeholders per review

Round-1 review follow-ups:
- Troubleshooting "Access forbidden": note that existing users must re-authorize
  once after switching to a static client (stored sessions were issued to the
  now-deleted DCR client).
- Default IdP setup: explain that the `/mcp` resource identifier works because
  `_has_mcp_audience` accepts both the bare server URL and the `/mcp` form.
- env.sample.oauth-multi-user: use angle-bracket placeholders
  (`<your-client-id>`) to match the template convention and fail loudly if
  copied verbatim.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/login-flow-v2.md

@@ -87,7 +87,7 @@ DCR clients after ~1 hour (see [Troubleshooting](#access-forbidden-after-the-con
    - **Redirect URI:** `https://<your-mcp-server>/oauth/callback`
    - **Flow / response type:** authorization **code**
    - **Type:** **confidential** (so it issues a client secret)
-   - **Resource identifier:** `https://<your-mcp-server>/mcp` (so issued tokens carry the MCP server's audience)
+   - **Resource identifier:** `https://<your-mcp-server>/mcp` (so issued tokens carry the MCP server's audience; the verifier's `_has_mcp_audience` accepts both this `/mcp` form and the bare server URL)
    - **Scopes:** leave empty to allow all, or list the per-app scopes you want plus `openid profile email offline_access`
 3. Copy the generated client ID and secret into `NEXTCLOUD_OIDC_CLIENT_ID` /
    `NEXTCLOUD_OIDC_CLIENT_SECRET`.
@@ -369,7 +369,9 @@ cached that now-deleted client in `tokens.db` and keeps reusing it.
 see [Default IdP setup](#default-idp-setup-nextclouds-built-in-oidc-app). Static
 clients are never auto-deleted. Set `NEXTCLOUD_OIDC_CLIENT_ID` /
 `NEXTCLOUD_OIDC_CLIENT_SECRET` (they take precedence over the cached DCR client)
-and recreate the container.
+and recreate the container. Existing users will need to re-authorize once after
+this switch — their stored sessions were issued to the now-deleted DCR client,
+so old refresh tokens no longer validate against the new static client.
 
 As a non-recommended stopgap you can extend the DCR client lifetime globally:
 `occ config:app:set oidc client_expire_time --value 31536000`.