fix: address critical code review issues (4 fixes)

This commit addresses 4 critical issues identified in code review:

1. **Token Rotation Race Condition** (token_broker.py)
   - Added per-user locking mechanism to prevent concurrent refresh token corruption
   - Implemented double-check pattern for cache after acquiring lock
   - Users can now safely refresh concurrently without token desync

2. **Hardcoded OAuth Client ID** (PHP files)
   - Made client ID configurable via `astroglobe_client_id` in system config
   - Updated McpServerClient to provide getClientId() method
   - Injected McpServerClient into IdpTokenRefresher and OAuthController
   - Updated admin settings UI to display client ID configuration status
   - App gracefully handles missing client ID with warnings in admin UI

3. **Missing Cache Invalidation** (management.py:revoke_user_access)
   - Added cache.invalidate() call when revoking user access
   - Ensures both storage AND cache are cleared atomically
   - Prevents stale cached tokens from being used after revocation

4. **Error Message Exposure** (management.py)
   - Created _sanitize_error_for_client() helper function
   - Updated all error handlers to log detailed errors internally
   - Returns generic messages to clients to prevent information leakage
   - Protects against exposing database paths, API URLs, tokens, etc.

All changes are backward compatible and preserve existing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

third_party/astroglobe/lib/Service/IdpTokenRefresher.php

@@ -21,15 +21,18 @@ class IdpTokenRefresher {
 	private $config;
 	private $httpClient;
 	private $logger;
+	private $mcpServerClient;
 
 	public function __construct(
 		IConfig $config,
 		IClientService $clientService,
 		LoggerInterface $logger,
+		McpServerClient $mcpServerClient,
 	) {
 		$this->config = $config;
 		$this->httpClient = $clientService->newClient();
 		$this->logger = $logger;
+		$this->mcpServerClient = $mcpServerClient;
 	}
 
 	/**
@@ -96,7 +99,7 @@ class IdpTokenRefresher {
 			$postData = [
 				'grant_type' => 'refresh_token',
 				'refresh_token' => $refreshToken,
-				'client_id' => 'nextcloudMcpServerUIPublicClient',
+				'client_id' => $this->mcpServerClient->getClientId(),
 				'client_secret' => $clientSecret,
 			];