fix: make ENABLE_PROGRESSIVE_CONSENT consistently opt-in (default false)

Fixes inconsistent default values for ENABLE_PROGRESSIVE_CONSENT across the
codebase. Previously had contradictory defaults (true in 4 files, false in 5).
Also removes the confusing REQUIRE_PROVISIONING variable.

Changes:
- app.py (2 locations): Changed default from "true" to "false"
- oauth_routes.py (2 locations): Changed default from "true" to "false"
- provisioning_decorator.py: Replaced REQUIRE_PROVISIONING with ENABLE_PROGRESSIVE_CONSENT
- Updated docstrings to clarify Progressive Consent is opt-in
- CLAUDE.md: Added comprehensive Progressive Consent documentation

Progressive Consent Mode (opt-in):
- Enable with ENABLE_PROGRESSIVE_CONSENT=true
- Dual OAuth flows: Flow 1 (client auth) + Flow 2 (resource provisioning)
- Flow 2 requires separate login outside MCP session
- Provides separation between session tokens and background job tokens

Default (Hybrid Flow):
- Single OAuth flow with server interception
- Backward compatible with existing deployments
- No separate provisioning step required

Testing:
- All 5 smoke tests passing (including OAuth)
- All 36 unit tests passing

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

nextcloud_mcp_server/app.py

@@ -564,9 +564,9 @@ async def setup_oauth_config():
         jwt_validation_issuer = issuer
         client_issuer = issuer
 
-    # Check if Progressive Consent mode is enabled
+    # Check if Progressive Consent mode is enabled (opt-in, defaults to false)
     enable_progressive = (
-        os.getenv("ENABLE_PROGRESSIVE_CONSENT", "true").lower() == "true"
+        os.getenv("ENABLE_PROGRESSIVE_CONSENT", "false").lower() == "true"
     )
 
     # Create token verifier
@@ -814,7 +814,7 @@ def get_app(transport: str = "sse", enabled_apps: list[str] | None = None):
     # Register OAuth provisioning tools if in OAuth mode with Progressive Consent
     if oauth_enabled:
         enable_progressive = (
-            os.getenv("ENABLE_PROGRESSIVE_CONSENT", "true").lower() == "true"
+            os.getenv("ENABLE_PROGRESSIVE_CONSENT", "false").lower() == "true"
         )
         if enable_progressive:
             logger.info("Registering OAuth provisioning tools for Progressive Consent")