fix(vector): propagate cancel in cleanup task; cover 403 + sweep-failure

Address round-1 review on #913 and the SonarCloud new_reliability_rating gate:

- credential_cleanup_task no longer catches the cancellation exception
  (Sonar python:S7497). A task-group cancel must propagate for structured-
  concurrency teardown; graceful shutdown still flows through shutdown_event,
  so the sleep no longer needs a cancel/break.
- Parametrize the scanner self-heal tests over 401 AND 403 (handled
  identically at both call sites) and add a test that a failing periodic
  sweep is logged non-fatally and does not crash the task.
- Log the stored-user count before the startup sweep (operability signal),
  add a debug line when the credential row was already gone, and document
  the at-most-one extra-401 convergence in _remove_stale_credential.

Refs Deck #198.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/vector/test_credential_self_heal.py

@@ -1,12 +1,14 @@
 """Unit tests: self-healing removal of stale app passwords (Deck #198).
 
 When a Nextcloud user is deleted/disabled, their stored app password keeps
-returning 401. Previously the scanner just stopped, leaving the credential in
+returning 401/403. Previously the scanner just stopped, leaving the credential in
 storage so ``user_manager_task`` re-spawned the scanner every poll interval — an
 endless re-spawn/401 loop. The scanner now deletes the credential on a hard auth
 failure, and a periodic ``credential_cleanup_task`` sweeps any that slip through.
 """
 
+import logging
+
 import anyio
 import httpx
 import pytest
@@ -16,10 +18,10 @@ from nextcloud_mcp_server.vector import oauth_sync
 pytestmark = pytest.mark.unit
 
 
-def _http_401() -> httpx.HTTPStatusError:
+def _http_error(status: int) -> httpx.HTTPStatusError:
     req = httpx.Request("GET", "https://cloud.example.org/ocs")
     return httpx.HTTPStatusError(
-        "unauth", request=req, response=httpx.Response(401, request=req)
+        "auth failure", request=req, response=httpx.Response(status, request=req)
     )
 
 
@@ -52,11 +54,12 @@ async def test_remove_stale_credential_swallows_storage_error(mocker):
     await oauth_sync._remove_stale_credential("ghost-user", 401)
 
 
-async def test_scanner_removes_credential_on_prevalidation_401(mocker):
-    """A 401 validating creds deletes the credential and never enters the scan
+@pytest.mark.parametrize("status", [401, 403])
+async def test_scanner_removes_credential_on_prevalidation_auth_failure(mocker, status):
+    """A 401/403 validating creds deletes the credential and never enters the scan
     loop — so ``user_manager_task`` won't see the user as provisioned again."""
     fake_client = mocker.AsyncMock()
-    fake_client.capabilities = mocker.AsyncMock(side_effect=_http_401())
+    fake_client.capabilities = mocker.AsyncMock(side_effect=_http_error(status))
     fake_client.close = mocker.AsyncMock()
     mocker.patch.object(
         oauth_sync,
@@ -82,8 +85,9 @@ async def test_scanner_removes_credential_on_prevalidation_401(mocker):
     storage.delete_app_password.assert_awaited_once_with("ghost-user")
 
 
-async def test_scanner_removes_credential_on_scan_loop_401(mocker):
-    """A 401 raised while scanning (not pre-validation) also deletes the
+@pytest.mark.parametrize("status", [401, 403])
+async def test_scanner_removes_credential_on_scan_loop_auth_failure(mocker, status):
+    """A 401/403 raised while scanning (not pre-validation) also deletes the
     credential before the scanner stops."""
     fake_client = mocker.AsyncMock()
     fake_client.capabilities = mocker.AsyncMock(return_value={})  # pre-validation ok
@@ -96,7 +100,7 @@ async def test_scanner_removes_credential_on_scan_loop_401(mocker):
     mocker.patch.object(
         oauth_sync,
         "scan_user_documents",
-        mocker.AsyncMock(side_effect=_http_401()),
+        mocker.AsyncMock(side_effect=_http_error(status)),
     )
     storage = mocker.MagicMock()
     storage.delete_app_password = mocker.AsyncMock(return_value=True)
@@ -137,3 +141,28 @@ async def test_credential_cleanup_task_sweeps_then_stops(mocker):
     storage.cleanup_invalid_app_passwords.assert_awaited_once_with(
         "https://cloud.example.org"
     )
+
+
+async def test_credential_cleanup_task_swallows_sweep_exception(mocker, caplog):
+    """A failing sweep is logged non-fatally and does not crash the task — the
+    loop survives to retry on the next cadence."""
+    mocker.patch.object(oauth_sync, "CREDENTIAL_CLEANUP_INTERVAL", 0)
+    shutdown = anyio.Event()
+    storage = mocker.MagicMock()
+
+    async def _boom(host):
+        shutdown.set()  # exit after this (failed) iteration
+        raise RuntimeError("sweep failed")
+
+    storage.cleanup_invalid_app_passwords = mocker.AsyncMock(side_effect=_boom)
+
+    with caplog.at_level(
+        logging.WARNING, logger="nextcloud_mcp_server.vector.oauth_sync"
+    ):
+        # Must return normally — the exception is swallowed, not propagated.
+        await oauth_sync.credential_cleanup_task(
+            storage, shutdown, "https://cloud.example.org"
+        )
+
+    storage.cleanup_invalid_app_passwords.assert_awaited_once()
+    assert "non-fatal" in caplog.text