test(astrolabe): migrate suite to session-JWT auth model

Astrolabe was refactored to mint session-derived JWTs (TokenGenerationRequest
Event) and a one-click background-indexing opt-in, dropping the OAuth
authorize/callback/refresh surface. Bump the submodule and bring the test
suite in line:

- New test_astrolabe_session_jwt_search.py: a logged-in user searches via the
  minted JWT with no provisioning (replaces the obsolete login_flow_provisioning
  OAuth-authorize test; token_refresh test deleted — refresh flow is gone).
- settings_buttons: assert the new revoke endpoint + that oauth/disconnect is
  gone (404).
- multi_user_background_sync / plotly / chunk_context: drop the OAuth authorize
  step; provision via the one-click "Enable background indexing" button
  (#mcp-enable-background-button -> #mcp-revoke-background-button) instead of
  generating + pasting an app password.
- docker-compose.yml: mount the astrolabe submodule into the app container.
- third_party/astrolabe: bump to the one-click opt-in commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_astrolabe_chunk_context.py

@@ -133,7 +133,6 @@ async def test_chunk_context_endpoint_uses_app_password(
     try:
         await login_to_nextcloud(page, username, password)
         auth_result = await complete_astrolabe_authorization(page, username, password)
-        assert auth_result["step1"], "OAuth authorization did not complete"
         assert auth_result["step2"], "App password provisioning did not complete"
 
         auth_header = _build_basic_auth_header(username, password)