refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

Nextcloud doesn't support OAuth bearer tokens without upstream patches,
making the RFC 8693 token exchange path untestable and dead code.

Removed:
- nextcloud_mcp_server/auth/token_exchange.py (597 lines)
- nextcloud_mcp_server/auth/keycloak_oauth.py (586 lines)
- OAUTH_TOKEN_EXCHANGE deployment mode from AuthMode enum
- get_session_client_from_context() from context_helper.py
- get_session_token() from token_broker.py
- enable_token_exchange / token_exchange_cache_ttl config fields
- oauth_token_exchange_total Prometheus metric
- Keycloak fixture block from tests/conftest.py (~408 lines)
- Token exchange unit tests from test_config_validators.py,
  test_unified_verifier.py, test_management_status_endpoint.py

Preserved:
- Multi-audience OAuth mode (OAUTH_SINGLE_AUDIENCE)
- Login Flow v2 provisioning with elicitation support
- Token broker background token management
- All existing test coverage for non-exchange paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/observability/metrics.py

@@ -125,12 +125,6 @@ oauth_token_validations_total = Counter(
     ["method", "result"],  # method: introspect | jwt; result: valid | invalid | error
 )
 
-oauth_token_exchange_total = Counter(
-    "mcp_oauth_token_exchange_total",
-    "Total OAuth token exchange operations (RFC 8693)",
-    ["status"],  # status: success | error
-)
-
 oauth_token_cache_hits_total = Counter(
     "mcp_oauth_token_cache_hits_total",
     "Total OAuth token cache lookups",

nextcloud_mcp_server/observability/tracing.py

@@ -232,7 +232,7 @@ def trace_oauth_operation(operation: str, details: dict[str, Any] | None = None)
             pass
 
     Args:
-        operation: OAuth operation name (e.g., "token.validate", "token.exchange")
+        operation: OAuth operation name (e.g., "token.validate", "token.refresh")
         details: Optional operation details (sensitive data will be sanitized)
 
     Returns: