fix(auth): address PR #758 auto-review (id-token verify, nonce, CI key)

Blocking:
- AS proxy callback now calls verify_id_token before caching the proxy
  code so a tampered IdP response can't smuggle identity claims.

Important:
- Browser OAuth flow generates and verifies an OIDC nonce; new alembic
  migration 006 adds the nonce column to oauth_sessions.
- _origin_matches_self logs a warning when CSRF check is bypassed.
- oauth_tools.py uses get_shared_storage instead of fresh handles.

Nits:
- New token_utils.get_oidc_discovery shares the 5-minute cache with
  verify_id_token; oauth_login (integrated) and _revoke_refresh_token_at_idp
  now use it instead of issuing fresh discovery fetches.
- Drop typing.Optional from oauth_tools.py in favour of X | None.

CI:
- test.yml generates an ephemeral Fernet TOKEN_ENCRYPTION_KEY per run
  with openssl, removing the dependency on a missing repo secret.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/token_utils.py

@@ -52,6 +52,17 @@ async def _get_cached(
     return data
 
 
+async def get_oidc_discovery(discovery_url: str) -> dict[str, Any]:
+    """Return the cached OIDC discovery document for *discovery_url*.
+
+    Shares the 5-minute discovery cache used by `verify_id_token`, so a
+    callback that does discovery → token-exchange → ID-token verification
+    reuses one HTTP round-trip instead of three. Public alias for `_get_cached`
+    against `_discovery_cache` (PR #758 nits 5 & 6).
+    """
+    return await _get_cached(_discovery_cache, discovery_url)
+
+
 async def verify_id_token(
     id_token: str,
     *,