docs(login-flow): require static OIDC client; remove dead OAuth env samples

Self-hosting login_flow against Nextcloud's built-in `oidc` app breaks after
~1h when relying on the DCR fallback: the `oidc` app deletes
dynamically-registered clients after `client_expire_time` (default 3600s),
pruning on every /authorize. The MCP server caches the now-deleted client, so
authorize/refresh fail with an "Access forbidden" page permanently — surviving
server restart and connector recreation (issue #907).

- docs/login-flow-v2.md: add "Default IdP setup (Nextcloud oidc app)" with
  static-client steps, and a Troubleshooting entry for the #907 symptom/fix;
  reframe the OIDC-client env vars as strongly recommended.
- docs/configuration.md: promote NEXTCLOUD_OIDC_CLIENT_ID/_SECRET to strongly
  recommended with a DCR-expiry warning; add them to the login_flow example.
- docker-compose.yml: clarify the DCR caveat and point self-hosters to a static
  client for login_flow / background sync.
- env.sample.oauth-multi-user: fix the removed `oauth_single_audience` value
  (now login_flow) and require a static OIDC client.
- env.sample.oauth-advanced: remove — it configured the removed OAuth
  token-exchange mode (no implementation remains; the mode value now errors at
  startup). Drop its references in configuration.md / configuration-migration-v2.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

env.sample.oauth-multi-user

@@ -1,10 +1,12 @@
 # ============================================
-# OAUTH MULTI-USER QUICK START (Recommended)
+# LOGIN FLOW v2 MULTI-USER QUICK START (Recommended)
 # ============================================
-# Multi-user deployment with OAuth authentication
-# Use for: Multi-user production deployments, enhanced security
-# Features: Single-audience tokens, automatic client registration (DCR)
+# Multi-user deployment with OAuth/OIDC authentication (ADR-022).
+# Use for: Multi-user production deployments, enhanced security.
+# The MCP server authenticates clients via OIDC and holds per-user
+# Nextcloud app passwords (encrypted) obtained via Login Flow v2.
 #
+# See docs/login-flow-v2.md for the full guide.
 # Copy this file to .env and configure
 
 # ===== REQUIRED SETTINGS =====
@@ -16,14 +18,17 @@ NEXTCLOUD_HOST=https://nextcloud.example.com
 NEXTCLOUD_USERNAME=
 NEXTCLOUD_PASSWORD=
 
-# ===== OPTIONAL: EXPLICIT MODE DECLARATION =====
-# Recommended for clarity
-MCP_DEPLOYMENT_MODE=oauth_single_audience
+# ===== REQUIRED: DEPLOYMENT MODE =====
+MCP_DEPLOYMENT_MODE=login_flow
 
-# ===== OPTIONAL: PRE-REGISTERED OAUTH CLIENT =====
-# If you pre-register the OAuth client instead of using DCR:
-#NEXTCLOUD_OIDC_CLIENT_ID=your-client-id
-#NEXTCLOUD_OIDC_CLIENT_SECRET=your-client-secret
+# ===== STRONGLY RECOMMENDED: STATIC OIDC CLIENT =====
+# Register a static client for the MCP server in your IdP and set these.
+# With Nextcloud's built-in `oidc` app you MUST do this: the DCR fallback
+# registers an ephemeral client that the app deletes after ~1h, which breaks
+# auth permanently ("Access forbidden" on reconnect — see issue #907).
+# Create one under Administration settings -> OpenID Connect provider.
+NEXTCLOUD_OIDC_CLIENT_ID=your-client-id
+NEXTCLOUD_OIDC_CLIENT_SECRET=your-client-secret
 
 # MCP Server URL (for OAuth redirects)
 NEXTCLOUD_MCP_SERVER_URL=http://localhost:8000
@@ -68,10 +73,11 @@ TOKEN_STORAGE_DB=/app/data/tokens.db
 # With ENABLE_SEMANTIC_SEARCH=true in OAuth mode:
 # ✅ Background operations enabled automatically
 # ✅ Refresh token storage enabled automatically
-# ✅ OAuth credentials required (DCR or pre-registered)
+# ✅ Static OIDC client credentials required (see above)
 # ✅ Encryption key required for token storage
 #
 # You only need to set ENABLE_SEMANTIC_SEARCH and provide the required
-# infrastructure (Qdrant, Ollama, encryption key). The rest is automatic!
+# infrastructure (static OIDC client, Qdrant, Ollama, encryption key).
+# The rest is automatic!
 
 # For more advanced configuration, see env.sample