refactor(vector-sync): clear SonarCloud gate + round-2 nits

Quality-gate fixes (new-code conditions on PR #902):
- new_security_hotspots_reviewed: drop the fake "http://nextcloud" host in the
  manager tests to https:// (python:S5332 ×2).
- new_security_rating: generate the integration test's fake app password with
  secrets.token_urlsafe instead of a hardcoded literal (python:S2068).
- new_reliability_rating: restructure the user_manager sleep so an explicit
  await checkpoint lives inside the cancellation scope — await one waiter
  directly while watching shutdown via start_soon (python:S7490). Behaviour is
  unchanged: timeout, shutdown, or a provisioning ring all end the sleep.

Review nits:
- Move the shutdown test's fail_after(2) to wrap the whole task group so it
  actually bounds the task-group exit (was guarding a no-op sleep); drop the
  sleep(0) stub (python:S7491).
- Type _wake_on's wait_fn as Callable[[], Awaitable[object]].
- Note in _wire_vector_sync_state why provision_signal is set on the singleton
  only, not fanned out to app.state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_login_flow_provision_wake.py

@@ -18,6 +18,7 @@ This is the Login Flow v2 deployment-mode counterpart to the multi-user
 BasicAuth coverage in ``test_app_password_provisioning.py``.
 """
 
+import secrets
 import tempfile
 import time
 from pathlib import Path
@@ -99,11 +100,14 @@ async def test_login_flow_provision_wakes_user_manager(temp_storage, mocker):
     )
 
     # ── mock only the Nextcloud Login Flow v2 poll ───────────────────────────
+    # Generated, not a hardcoded literal — keeps this a fake token, not a
+    # credential pattern (SonarQube python:S2068).
+    fake_app_password = secrets.token_urlsafe(24)
     completed = LoginFlowPollResult(
         status="completed",
         server="https://cloud.example.com",
         login_name="alice",
-        app_password="aaaaa-bbbbb-ccccc-ddddd-eeeee",
+        app_password=fake_app_password,
     )
     flow_client = AsyncMock()
     flow_client.poll.return_value = completed