fix(vector): address PR #873 round-2 review

- Correct the misleading `test_malformed_envelope_returns_empty_set`
  docstring: an empty-set return does NOT trigger the
  `_get_enabled_apps_or_none` scan-all fallback (which fires only on
  exceptions); optional apps are gated off for that cycle, Files unaffected.
- Check OCS `meta.status` in `get_enabled_apps`: a 200 carrying
  `status != "ok"` now raises, so a 200-with-failure envelope routes through
  the scanner's scan-all fallback instead of silently gating every app off.
  Add a test for the failure-status raise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/client/__init__.py

@@ -218,6 +218,15 @@ class NextcloudClient:
         # ``ocs``/``data`` (``{"ocs": null}``) coerces to empty instead of
         # raising AttributeError on ``None.get``.
         ocs = data.get("ocs") or {}
+        # A 200 carrying ``meta.status != "ok"`` is an OCS-level failure (auth /
+        # permission edge cases) that ``raise_for_status`` can't see. Raise so
+        # the scanner's ``_get_enabled_apps_or_none`` catches it and falls back
+        # to scanning every app, rather than silently gating all apps off for a
+        # cycle on an empty ``data``. Tolerate a missing/empty meta (our own
+        # mocks, and any envelope that omits it).
+        status = (ocs.get("meta") or {}).get("status")
+        if status not in ("ok", None, ""):
+            raise ValueError(f"OCS navigation returned status={status!r}")
         entries = ocs.get("data") or []
         enabled: set[str] = set()
         for entry in entries: