feat: add scope protection to OAuth provisioning tools

Add @require_scopes("openid") decorator to OAuth backend tools
(provision_nextcloud_access, revoke_nextcloud_access, check_provisioning_status)
to ensure they're only visible to authenticated OIDC users.

Design rationale:
- OAuth provisioning tools are "meta-tools" that manage authentication itself
- They don't access Nextcloud resources, so don't need resource scopes
- Requiring 'openid' ensures user is authenticated via OIDC
- Enables Progressive Consent: users authenticate first, then provision access
- Aligns with dual OAuth flow architecture (Flow 1 + Flow 2)

Changes:
- Add @require_scopes("openid") to all three OAuth provisioning tools
- Update test expectations: users with only OIDC default scopes
  see OAuth provisioning tools but not resource tools
- All tests pass (13/13 in test_scope_authorization.py)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

nextcloud_mcp_server/server/oauth_tools.py

@@ -14,6 +14,7 @@ from urllib.parse import urlencode
 from mcp.server.fastmcp import Context
 from pydantic import BaseModel, Field
 
+from nextcloud_mcp_server.auth import require_scopes
 from nextcloud_mcp_server.auth.refresh_token_storage import RefreshTokenStorage
 from nextcloud_mcp_server.auth.token_broker import TokenBrokerService
 
@@ -401,6 +402,7 @@ def register_oauth_tools(mcp):
             "You'll need to complete an OAuth authorization in your browser."
         ),
     )
+    @require_scopes("openid")
     async def tool_provision_access(
         ctx: Context,
         user_id: Optional[str] = None,
@@ -411,6 +413,7 @@ def register_oauth_tools(mcp):
         name="revoke_nextcloud_access",
         description="Revoke offline access to Nextcloud resources.",
     )
+    @require_scopes("openid")
     async def tool_revoke_access(
         ctx: Context, user_id: Optional[str] = None
     ) -> RevocationResult:
@@ -420,6 +423,7 @@ def register_oauth_tools(mcp):
         name="check_provisioning_status",
         description="Check whether Nextcloud access is provisioned.",
     )
+    @require_scopes("openid")
     async def tool_check_status(
         ctx: Context, user_id: Optional[str] = None
     ) -> ProvisioningStatus: