fix: discover Login Flow v2 users in OAuth mode user manager

When enable_login_flow is true, also check the app_passwords table
for provisioned users. Previously, OAuth mode only queried the
refresh_tokens table, missing users who were provisioned via
Login Flow v2 (which stores app passwords, not refresh tokens).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -6,6 +6,7 @@ COPY --from=ghcr.io/astral-sh/uv:0.10.12@sha256:72ab0aeb448090480ccabb99fb5f52b0
 # 1. git (required for caldav dependency from git)
 # 2. sqlite for development with token db
 RUN apt update && apt install --no-install-recommends --no-install-suggests -y \
+    curl \
     git \
     tesseract-ocr \
     sqlite3 && apt clean

nextcloud_mcp_server/vector/oauth_sync.py

@@ -496,6 +496,14 @@ async def user_manager_task(
             else:
                 # OAuth mode: query refresh_tokens table
                 provisioned_users = set(await refresh_token_storage.get_all_user_ids())
+                # Login Flow mode: also check app_passwords table
+                # (users provisioned via Login Flow v2 have app passwords,
+                # not refresh tokens)
+                if settings.enable_login_flow:
+                    app_pw_users = set(
+                        await refresh_token_storage.get_all_app_password_user_ids()
+                    )
+                    provisioned_users |= app_pw_users
             active_users = set(user_states.keys())
 
             # Start scanners for new users