docs: address round-3 review (compose excerpt, ADR-004 notes, placeholder)

- login-flow-v2.md: add commented-out NEXTCLOUD_OIDC_CLIENT_ID/_SECRET (with a
  "production: register a static client" note) to the Docker Compose excerpt so
  copy-pasters of the rendered snippet don't fall into the #907 DCR-expiry trap.
- ADR-004: rename "## Implementation Status" -> "## Historical Implementation
  Notes" and add a banner clarifying the steps were never completed and the
  ENABLE_TOKEN_EXCHANGE symbols no longer exist (the design was superseded).
- env.sample.oauth-multi-user: angle-bracket the TOKEN_ENCRYPTION_KEY
  placeholder for consistency with the OIDC client placeholders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/ADR-004-mcp-application-oauth.md

@@ -1539,11 +1539,16 @@ The **Progressive Consent architecture** solves the critical challenges of token
 
 This architecture follows industry best practices for federated systems and positions the MCP server as a secure token broker in an enterprise identity ecosystem.
 
-## Implementation Status
+## Historical Implementation Notes
 
-**Current Status**: Partially Implemented (Refactoring Required)
+> These were the planned refactoring steps at the time this ADR was written.
+> They were **never completed** — the design was superseded by ADR-022 (Login
+> Flow v2) and ADR-023 (OAuth AS proxy) before this progressive-consent /
+> token-exchange architecture was adopted. The `ENABLE_TOKEN_EXCHANGE` /
+> `settings.enable_token_exchange` symbols referenced below no longer exist in
+> the codebase. Retained for historical context only.
 
-The current implementation (`nextcloud_mcp_server/auth/oauth_routes.py`) implements a **simplified hybrid flow** but needs refactoring to match the progressive consent architecture documented above:
+The implementation at the time (`nextcloud_mcp_server/auth/oauth_routes.py`) was a **simplified hybrid flow** that would have needed refactoring to match the progressive consent architecture documented above:
 
 ### What's Currently Implemented ✅
 

docs/login-flow-v2.md

@@ -193,6 +193,11 @@ mcp-login-flow:
     - NEXTCLOUD_MCP_SERVER_URL=http://localhost:8004
     - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
     - MCP_DEPLOYMENT_MODE=login_flow
+    # Production: register a static OIDC client and set these — the DCR
+    # fallback used by this dev/test service expires after ~1h against the
+    # built-in `oidc` app (see "Default IdP setup" above and #907).
+    # - NEXTCLOUD_OIDC_CLIENT_ID=<your-client-id>
+    # - NEXTCLOUD_OIDC_CLIENT_SECRET=<your-client-secret>
     # Dev-only inline value. In production, mount via Docker secret and read
     # from a *_FILE env var or a secrets-management init step.
     - TOKEN_ENCRYPTION_KEY=<your-fernet-key>

env.sample.oauth-multi-user

@@ -60,7 +60,7 @@ OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 
 # Token Storage (required for background operations - auto-enabled by semantic search)
 # Generate encryption key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-TOKEN_ENCRYPTION_KEY=your-encryption-key-here
+TOKEN_ENCRYPTION_KEY=<your-encryption-key>
 TOKEN_STORAGE_DB=/app/data/tokens.db
 
 # ===== OPTIONAL: DOCUMENT PROCESSING =====