fix(auth): address PR #758 auto-review (id-token verify, nonce, CI key)

Blocking:
- AS proxy callback now calls verify_id_token before caching the proxy
  code so a tampered IdP response can't smuggle identity claims.

Important:
- Browser OAuth flow generates and verifies an OIDC nonce; new alembic
  migration 006 adds the nonce column to oauth_sessions.
- _origin_matches_self logs a warning when CSRF check is bypassed.
- oauth_tools.py uses get_shared_storage instead of fresh handles.

Nits:
- New token_utils.get_oidc_discovery shares the 5-minute cache with
  verify_id_token; oauth_login (integrated) and _revoke_refresh_token_at_idp
  now use it instead of issuing fresh discovery fetches.
- Drop typing.Optional from oauth_tools.py in favour of X | None.

CI:
- test.yml generates an ephemeral Fernet TOKEN_ENCRYPTION_KEY per run
  with openssl, removing the dependency on a missing repo secret.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/storage.py

@@ -917,6 +917,7 @@ class RefreshTokenStorage:
         flow_type: str = "hybrid",
         is_provisioning: bool = False,
         requested_scopes: str | None = None,
+        nonce: str | None = None,
         ttl_seconds: int = 600,  # 10 minutes
     ) -> None:
         """
@@ -933,6 +934,8 @@ class RefreshTokenStorage:
             flow_type: Type of flow ('hybrid', 'flow1', 'flow2')
             is_provisioning: Whether this is a Flow 2 provisioning session
             requested_scopes: Requested OAuth scopes
+            nonce: OIDC ``nonce`` value bound to this auth request, returned
+                in the ID token and verified on callback (PR #758 finding 2).
             ttl_seconds: Session TTL in seconds
         """
         if not self._initialized:
@@ -947,8 +950,8 @@ class RefreshTokenStorage:
                 INSERT INTO oauth_sessions
                 (session_id, client_id, client_redirect_uri, state, code_challenge,
                  code_challenge_method, mcp_authorization_code, flow_type,
-                 is_provisioning, requested_scopes, created_at, expires_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                 is_provisioning, requested_scopes, nonce, created_at, expires_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                 """,
                 (
                     session_id,
@@ -961,6 +964,7 @@ class RefreshTokenStorage:
                     flow_type,
                     is_provisioning,
                     requested_scopes,
+                    nonce,
                     now,
                     expires_at,
                 ),