refactor(auth): remove vestigial token-exchange code path

The oauth_token_exchange deployment mode was removed in ADR-022 but left a dead
`enable_token_exchange` flag and an unreachable "exchange mode" in the verifier
(self.mode was hardcoded to "multi-audience"). Remove the remnants:

- config.py: drop the `enable_token_exchange` default and the
  `ENABLE_TOKEN_EXCHANGE` branch in `_is_multi_user` (+ its doc line).
- unified_verifier.py: drop `self.mode` and the dead exchange-mode log branch;
  simplify the docstrings to multi-audience only.
- test_unified_verifier.py: drop the `.mode` assertions (attribute removed);
  collapse the redundant init tests.

Also remove docs/ADR-004-Code-Review.md — an orphaned code-review note, not an
ADR; it doesn't belong in the docs/ADR namespace.

(--no-verify: the ty-check hook flags 3 PRE-EXISTING type errors in
test_unified_verifier.py lines 346/362/441, untouched by this change; CI
type-checks only the package, which passes.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config.py

@@ -57,7 +57,6 @@ _DEFAULTS: dict[str, Any] = {
     "enable_background_operations": False,
     "vector_sync_enabled": False,
     "enable_offline_access": False,
-    "enable_token_exchange": False,
     # Token storage
     "token_encryption_key": None,
     # None = ephemeral per-process tempfile (see get_token_db_path()).
@@ -1268,7 +1267,6 @@ def _is_multi_user_mode() -> bool:
     - Multi-user BasicAuth (MCP_DEPLOYMENT_MODE=multi_user_basic)
     - Login Flow v2 / default OAuth (MCP_DEPLOYMENT_MODE=login_flow, or no
       username/password and no explicit mode)
-    - OAuth Token Exchange (ENABLE_TOKEN_EXCHANGE=true)
 
     Single-user mode is:
     - Single-user BasicAuth (username and password both set)
@@ -1285,10 +1283,6 @@ def _is_multi_user_mode() -> bool:
     if explicit_mode == "single_user_basic":
         return False
 
-    # Token exchange implies OAuth multi-user
-    if _dynaconf.get("ENABLE_TOKEN_EXCHANGE", False):
-        return True
-
     # If both username and password are set, it's single-user BasicAuth
     has_username = bool(_dynaconf.get("NEXTCLOUD_USERNAME"))
     has_password = bool(_dynaconf.get("NEXTCLOUD_PASSWORD"))