fix: Complete Keycloak external IdP integration with all tests passing

This commit completes the Keycloak external IdP integration for the MCP
server, implementing ADR-002 Tier 2 (External Identity Provider) with
full Bearer token authentication support.

Key Changes:
1. **Keycloak backchannel-dynamic configuration**
   - Added --hostname-strict=false and --hostname-backchannel-dynamic=true
   - Allows external issuer (localhost:8888) with internal endpoints (keycloak:8080)
   - Solves Docker networking issue where containers can't reach localhost

2. **CORSMiddleware Bearer token patch**
   - Created app-hooks/patches/cors-bearer-token.patch from upstream commit 8fb5e77db82
   - Allows Bearer tokens to bypass CORS/CSRF checks (stateless authentication)
   - Applied via post-installation hook 20-apply-cors-bearer-token-patch.sh
   - Enables app-specific APIs (Notes, Calendar, etc.) to work with Bearer tokens

3. **Patch organization**
   - Moved patches to app-hooks/patches/ directory
   - Updated docker-compose.yml to mount entire app-hooks directory
   - Consolidated patch management for better maintainability

4. **Test improvements**
   - All 11 Keycloak integration tests passing
   - Tests validate OAuth token acquisition, MCP connectivity, token validation,
     tool execution, token persistence, user provisioning, scope filtering,
     and error handling

Architecture:
- Keycloak acts as external OAuth/OIDC identity provider
- MCP server uses Keycloak tokens to access Nextcloud APIs
- Nextcloud user_oidc app validates Bearer tokens from Keycloak
- No admin credentials needed - all API access uses user's OAuth tokens

Cache Note:
- Discovery and JWKS caches must be cleared when switching Keycloak configurations
- Use: docker compose exec redis redis-cli DEL "<cache-key>"
- Or: docker compose exec app php occ user_oidc:provider keycloak --clientid nextcloud

Related:
- ADR-002: Vector sync background jobs authentication
- Validates external IdP integration pattern
- Demonstrates offline_access with refresh tokens (Tier 1 & 2)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/load/oauth_benchmark.py

@@ -27,7 +27,8 @@ import click
 import httpx
 from playwright.async_api import async_playwright
 
-from nextcloud_mcp_server.auth.client_registration import load_or_register_client
+from nextcloud_mcp_server.auth.client_registration import ensure_oauth_client
+from nextcloud_mcp_server.auth.refresh_token_storage import RefreshTokenStorage
 from nextcloud_mcp_server.client import NextcloudClient
 from tests.load.oauth_metrics import OAuthBenchmarkMetrics
 from tests.load.oauth_pool import (
@@ -142,7 +143,7 @@ async def setup_oauth_client(
     nextcloud_host: str, callback_url: str, registration_endpoint: str
 ) -> dict[str, str]:
     """
-    Setup OAuth client using load_or_register_client.
+    Setup OAuth client using ensure_oauth_client with SQLite storage.
 
     Args:
         nextcloud_host: Nextcloud host URL
@@ -154,11 +155,15 @@ async def setup_oauth_client(
     """
     logger.info("Setting up OAuth client...")
 
-    # Use the client registration utility
-    client_info = await load_or_register_client(
+    # Initialize SQLite storage
+    storage = RefreshTokenStorage.from_env()
+    await storage.initialize()
+
+    # Use the client registration utility with SQLite storage
+    client_info = await ensure_oauth_client(
         nextcloud_url=nextcloud_host,
         registration_endpoint=registration_endpoint,
-        storage_path=".nextcloud_oauth_benchmark_client.json",
+        storage=storage,
         client_name="OAuth Benchmark Test Client",
         redirect_uris=[callback_url],
     )