fix(vector): nested-group drop classification + review/Sonar fixes (#893)

Round-1 review on PR #893:
- _drop_reason now descends through nested ExceptionGroups to the first leaf
  (was single-level), so a doubly-wrapped cause isn't mislabelled "other";
  added a nested-group test. Commented why both the httpx and openai isinstance
  branches exist (raw Nextcloud-API errors vs SDK-wrapped variants).
- Documented that generate() intentionally shares the broadened transient retry
  (RAG sampling path), with the worst-case latency note.
- Added a docstring note to process_document on how the provider-level retry
  (5x) layers over the outer loop (3x in-process / 1x procrastinate).
- Added test_embed_batch_retries_on_connection_error for the batch path.
- Renamed test_retry_reraises_non_rate_limit_immediately ->
  test_retry_reraises_when_predicate_returns_false (it tests the predicate, not
  a specific status).

SonarCloud:
- S5708 (BLOCKER) on the helper's dynamic `except exception_type`: the type is
  constrained to BaseException/tuple by the signature; suppressed with a
  justified NOSONAR.
- S7503 (async without await) in the embed-retry test: use AsyncMock side_effect
  instead of a hand-rolled async function.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/providers/_retry.py

@@ -56,7 +56,10 @@ def retry_on_transient(
             for attempt in range(1, MAX_RETRIES + 1):
                 try:
                     return await func(*args, **kwargs)
-                except exception_type as e:
+                # exception_type is constrained by the signature to a
+                # BaseException subclass or a tuple of them; the dynamic catch is
+                # the whole point of this reusable helper.
+                except exception_type as e:  # NOSONAR(S5708)
                     if not should_retry(e):
                         raise
                     last_error = e

nextcloud_mcp_server/providers/openai.py

@@ -283,6 +283,10 @@ class OpenAIProvider(Provider):
             )
         return self._dimension
 
+    # Transient retry intentionally covers generation too (RAG sampling path):
+    # a pod rollover breaks generation as readily as embedding. Worst case adds
+    # ~30s (5 attempts, 2s→60s backoff) to an interactive call hitting a
+    # sustained connection issue, which is preferable to a hard failure.
     @_retry_transient
     async def generate(self, prompt: str, max_tokens: int = 500) -> str:
         """