fix(auth): authenticate stored app passwords with loginName, not UID

Nextcloud authenticates app passwords against the *loginName*, which differs
from the UID for OIDC-provisioned users (e.g. user_oidc makes the UID the
display name: UID "Ada Lovelace", loginName "ada@example.com"). The runtime
consumers of stored app passwords bound the UID as the BasicAuth username, so
every Notes/Files/Shares/CalDAV call returned HTTP 401.

PR #818 fixed only the provisioning endpoint; the consuming paths were missed.
Observed on a login_flow tenant (NC's own OIDC app as IdP): the background-sync
scan loop never started ("Credential validation failed ... HTTP 401") and
semantic search returned 0 results because the ACL shared_with_me lookup 401'd
and degraded to a self-only owner filter.

Root cause: NextcloudClient / CalendarClient conflated two identities — the
DAV/URL path identity (the user_id the whole system keys on = NC UID) and the
auth-credential username (the loginName). Decouple them:

- Thread a keyword-only auth_username through NextcloudClient -> CalendarClient
  (defaults to username, so single-user / OAuth where UID == loginName is
  unchanged).
- get_user_client_basic_auth (background sync + the /api/v1/vector-viz/search
  endpoint) authenticates as the stored loginName, UID for paths.
- _get_client_from_login_flow (the get_client(ctx) MCP-tool path) does the same.
- cleanup_invalid_app_passwords validates with the loginName, so it no longer
  401s and wrongly deletes a valid OIDC user's password.

The loginName is already persisted in app_passwords.username and returned by
get_app_password_with_scopes. Adds unit tests covering the UID != loginName
split for both client builders, the calendar credential/path split, and the
cleanup validation. Also genericises the example user in the #818 comment/test
(real name/email -> Ada Lovelace / ada@example.com).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/context.py

@@ -191,13 +191,27 @@ async def _get_client_from_login_flow(
             "Call nc_auth_provision_access to complete Login Flow."
         )
 
-    username = app_data.get("username") or user_id
+    # Authenticate with the stored Nextcloud loginName, but build DAV/API paths
+    # with ``user_id`` — the identity the rest of the system is keyed on (the
+    # app-password store, vector payloads, scopes, and the background-sync
+    # ``get_user_client_basic_auth`` all use it). For OIDC-provisioned users the
+    # loginName (e.g. an email) differs from this identity, and Nextcloud
+    # authenticates app passwords against the loginName. Falls back to
+    # ``user_id`` for legacy rows stored without a loginName.
+    login_name = app_data.get("username") or user_id
+    app_password = app_data["app_password"]
 
-    logger.debug("Creating Login Flow v2 client for %s as %s", nextcloud_host, username)
+    logger.debug(
+        "Creating Login Flow v2 client for %s (id=%s, login=%s)",
+        nextcloud_host,
+        user_id,
+        login_name,
+    )
 
     return NextcloudClient(
         base_url=nextcloud_host,
-        username=username,
-        auth=BasicAuth(username, app_data["app_password"]),
-        password=app_data["app_password"],
+        username=user_id,
+        auth_username=login_name,
+        auth=BasicAuth(login_name, app_password),
+        password=app_password,
     )