refactor: remove ALLOWED_MCP_CLOUD_CLIENTS and add keycloak CI profile

Remove the unused ALLOWED_MCP_CLOUD_CLIENTS env var — all clients are
defined via ALLOWED_MCP_CLIENTS or the static well-known defaults.
Add keycloak as an integration test profile in CI now that login-flow
replaces the old bearer token approach for external IdPs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/client_registry.py

@@ -61,14 +61,6 @@ class ClientRegistry:
         - https:// redirect URIs are allowed (cloud clients)
         - http:// non-localhost redirect URIs are rejected with a warning
         """
-        # Deprecation warning for old env var
-        if os.getenv("ALLOWED_MCP_CLOUD_CLIENTS"):
-            logger.warning(
-                "ALLOWED_MCP_CLOUD_CLIENTS is deprecated. "
-                "Merge entries into ALLOWED_MCP_CLIENTS using the format: "
-                "client_id|https://redirect-uri"
-            )
-
         allowed_clients = os.getenv("ALLOWED_MCP_CLIENTS", "").strip()
 
         if allowed_clients: