test: address PR #707 reviewer feedback on config path helpers

- _resolve_settings_files() now raises FileNotFoundError when
  NEXTCLOUD_MCP_SETTINGS_FILE points to a missing file, instead of
  silently falling back to defaults (footgun on typos).
- .secrets.toml is now looked for alongside the explicit settings file
  when NEXTCLOUD_MCP_SETTINGS_FILE is set, matching user expectation for
  /etc-style deployments. Unset behaviour (cwd lookup) is unchanged.
- get_token_db_path() drops the redundant os.environ.get() short-circuit;
  TOKEN_STORAGE_DB is already bound through dynaconf because the key is
  declared in _DEFAULTS.
- is_ephemeral_token_db() docstring documents the "must call
  get_token_db_path() first" precondition.
- alembic.ini comment clarifies the ./tokens.db placeholder is cwd-relative
  by design and points readers at the -x database_url escape hatch.
- New tests/unit/test_config_paths.py (12 tests) covering the ephemeral
  tempfile lifecycle, the TOKEN_STORAGE_DB override path, and all six
  _resolve_settings_files() cases including the two new behaviours.

Full unit suite now at 476 passed (464 + 12 new). Ruff + ty clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

alembic.ini

@@ -44,7 +44,11 @@ path_separator = os
 # Runtime code (migrations.get_alembic_config / alembic/env.get_database_url)
 # overrides this with config.get_token_db_path() which defaults to an
 # ephemeral per-process tempfile unless TOKEN_STORAGE_DB is set.
-# This value only matters for manual `alembic` invocations from the repo root.
+# This value only matters for manual `alembic` invocations (e.g.
+# `uv run alembic current`). The `./tokens.db` path is intentionally
+# resolved relative to the shell's current working directory at the time
+# of invocation — run alembic from the repo root for predictable behaviour,
+# or pass `-x database_url=sqlite+aiosqlite:///<abs-path>`.
 sqlalchemy.url = sqlite+aiosqlite:///./tokens.db
 
 [post_write_hooks]