fix(auth): address PR #757 round-2 review feedback

Four review items from the second-round review on PR #757:

- scope_authorization: broaden the post-elicit retry message to acknowledge
  the 5-minute scope-cache TTL — if the LFv2 poller is still in-flight at
  acknowledge-time, the immediate retry can still hit a stale cache.
- elicitation: extract a shared `_run_elicit(ctx, message, schema, *,
  log_label)` helper so `present_login_url` and
  `present_provisioning_required` no longer duplicate the
  hasattr-guard / try-NotImplementedError / try-Exception fallback block.
  The data-acknowledged warning specific to login-flow stays in
  `present_login_url` so behaviour is preserved exactly.
- elicitation: detect missing http:// / https:// scheme in
  `_astrolabe_settings_url`, log a warning, and return None — caller
  renders the safe tool-only fallback instead of producing a broken link.
  New unit test locks this in.
- browser_oauth_routes: replace the stray
  `os.getenv(\"NEXTCLOUD_HOST\")` in `_should_use_secure_cookies` with
  `get_settings().nextcloud_host` for consistency with the rest of the
  file (PR #757 review nit).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/test_elicitation.py

@@ -63,6 +63,20 @@ def test_astrolabe_settings_url_returns_none_when_unset():
         assert _astrolabe_settings_url() is None
 
 
+def test_astrolabe_settings_url_returns_none_when_scheme_missing(caplog):
+    """Bare hostname (no http:// or https://) → None + a warning so the operator
+    sees the misconfiguration instead of getting a silently-broken URL."""
+    fake = _fake_settings(host="internal-host:8080")
+    with patch("nextcloud_mcp_server.auth.elicitation.get_settings", return_value=fake):
+        with caplog.at_level("WARNING", logger="nextcloud_mcp_server.auth.elicitation"):
+            assert _astrolabe_settings_url() is None
+    assert any(
+        "missing an http:// or https://" in rec.message for rec in caplog.records
+    ), (
+        f"expected scheme-missing warning, got records={[r.message for r in caplog.records]}"
+    )
+
+
 async def test_present_provisioning_required_elicits_with_url():
     """When NC URL is set and the client supports elicitation, send the URL."""
     fake = _fake_settings(public_issuer_url="https://nc.example.com")