docs: clear review-round-3 nits — stale login_flow_v2, duplicates, field comments

Five small findings from the reviewer's third round, plus a SonarCloud
quality-gate failure on a test fixture.

- docs/troubleshooting.md, docs/configuration.md: six pre-PR references
  to a non-existent `login_flow_v2` mode value (the actual enum value is
  `login_flow`). They predated this PR but became actively misleading
  once `detect_auth_mode` started raising ValueError for anything not in
  the mode_map. Replaced with `login_flow` via sed.
- docs/configuration-migration-v2.md: removed a duplicate
  `MCP_DEPLOYMENT_MODE=multi_user_basic` line in the troubleshooting
  section (around line 447) — same shape as the round-2 duplicate
  caught earlier in the migration-steps section. Also dropped the
  `oauth_token_exchange` row from the mode-value table around line 364
  (that enum value was removed in 57303135 and would now raise
  ValueError from detect_auth_mode).
- nextcloud_mcp_server/config.py: field comments for
  `enable_multi_user_basic_auth` and `enable_login_flow` said
  "Auto-set by detect_auth_mode()" but the derivation moved into
  `Settings.__post_init__` in the previous commit. Updated both.
- tests/unit/test_config_validators.py: SonarCloud's python:S2068
  flagged `nextcloud_password="hunter2"` in the
  `test_login_flow_mode_auto_derives_enable_login_flow_flag` fixture I
  added in commit 5 as a potentially hard-coded credential. Other
  fixtures in the same file use the literal `"password"` and aren't
  flagged (they predate the PR and SonarCloud only checks new-code).
  Switched to `"password"` to match the existing convention.

No functional changes; all 1009 unit tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/configuration-migration-v2.md

@@ -360,8 +360,7 @@ NEXTCLOUD_HOST=https://nextcloud.example.com
 |-----------|-------------|
 | `single_user_basic` | Single-user with username/password |
 | `multi_user_basic` | Multi-user with BasicAuth pass-through |
-| `login_flow` | Multi-user OAuth (recommended) |
-| `oauth_token_exchange` | Multi-user OAuth with token exchange |
+| `login_flow` | Multi-user OAuth via Login Flow v2 (recommended) |
 
 ### Mode Detection Priority
 
@@ -445,7 +444,6 @@ Server activates `login_flow` mode when you expected `multi_user_basic`
 Add explicit mode declaration:
 ```bash
 MCP_DEPLOYMENT_MODE=multi_user_basic
-MCP_DEPLOYMENT_MODE=multi_user_basic
 ```
 
 ---

docs/configuration.md

@@ -38,12 +38,12 @@ The server supports three deployment modes. See [Authentication](authentication.
 |------|-------------|
 | `single_user_basic` | Personal use, dev — credentials in env vars |
 | `multi_user_basic` | Internal deployments — clients send credentials via `Authorization: Basic` header |
-| `login_flow_v2` | Hosted / OAuth-based MCP clients (claude.ai, Astrolabe Cloud) — recommended for multi-user |
+| `login_flow` | Hosted / OAuth-based MCP clients (claude.ai, Astrolabe Cloud) — recommended for multi-user |
 
 You can declare the mode explicitly:
 
 ```dotenv
-MCP_DEPLOYMENT_MODE=login_flow_v2
+MCP_DEPLOYMENT_MODE=login_flow
 ```
 
 If `MCP_DEPLOYMENT_MODE` is not set, the server auto-detects from the other env vars below.

docs/troubleshooting.md

@@ -69,7 +69,7 @@ ENABLE_BACKGROUND_OPERATIONS=true
 
 **Symptom:**
 ```
-ValueError: Invalid MCP_DEPLOYMENT_MODE: 'oauth'. Valid values: single_user_basic, multi_user_basic, login_flow_v2
+ValueError: Invalid MCP_DEPLOYMENT_MODE: 'oauth'. Valid values: single_user_basic, multi_user_basic, login_flow
 ```
 
 **Cause:** Invalid value for `MCP_DEPLOYMENT_MODE`.
@@ -79,7 +79,7 @@ Use one of the valid mode values:
 ```bash
 MCP_DEPLOYMENT_MODE=single_user_basic   # Single-user with username/app password
 MCP_DEPLOYMENT_MODE=multi_user_basic    # Multi-user BasicAuth pass-through
-MCP_DEPLOYMENT_MODE=login_flow_v2       # Multi-user via Login Flow v2 (recommended)
+MCP_DEPLOYMENT_MODE=login_flow       # Multi-user via Login Flow v2 (recommended)
 ```
 
 Or remove `MCP_DEPLOYMENT_MODE` to use automatic detection.
@@ -90,7 +90,7 @@ Or remove `MCP_DEPLOYMENT_MODE` to use automatic detection.
 
 **Symptom:**
 ```
-Error: [login_flow_v2] TOKEN_ENCRYPTION_KEY is required when ENABLE_SEMANTIC_SEARCH is enabled
+Error: [login_flow] TOKEN_ENCRYPTION_KEY is required when ENABLE_SEMANTIC_SEARCH is enabled
 ```
 
 **Cause:** In multi-user modes, semantic search automatically enables background operations, which require encrypted token storage.
@@ -441,7 +441,7 @@ If problems persist, open an issue on the [GitHub repository](https://github.com
 
 - **Server logs** (with `--log-level debug`)
 - **Nextcloud version**
-- **Deployment mode** (single_user_basic / multi_user_basic / login_flow_v2)
+- **Deployment mode** (single_user_basic / multi_user_basic / login_flow)
 - **Error messages**
 - **Steps to reproduce**
 - **Environment details** (OS, Python version, Docker vs local)

nextcloud_mcp_server/config.py

@@ -456,14 +456,14 @@ class Settings:
     # Multi-user BasicAuth pass-through mode (ADR-019 interim solution).
     # Internal — not user-settable; the ENABLE_MULTI_USER_BASIC_AUTH env-var
     # alias was removed in the ADR-022 follow-up. Auto-set by
-    # detect_auth_mode() when MCP_DEPLOYMENT_MODE=multi_user_basic. When True,
+    # Settings.__post_init__ when MCP_DEPLOYMENT_MODE=multi_user_basic. When True,
     # the MCP server extracts BasicAuth credentials from request headers and
     # passes them through to Nextcloud APIs (no storage, stateless). Kept
     # as a field for backward compat with the runtime call sites that read it.
     enable_multi_user_basic_auth: bool = False
 
     # Login Flow v2 derived flag (ADR-022). Internal — not user-settable.
-    # Auto-set by detect_auth_mode() when the resolved deployment mode is
+    # Auto-set by Settings.__post_init__ when the resolved deployment mode is
     # LOGIN_FLOW. Kept as a field for backward compat with the runtime call
     # sites that read it (app.py, context.py, scope_authorization.py).
     enable_login_flow: bool = False

tests/unit/test_config_validators.py

@@ -387,7 +387,7 @@ class TestLoginFlowValidation:
         basic_settings = Settings(
             nextcloud_host="http://localhost",
             nextcloud_username="alice",
-            nextcloud_password="hunter2",
+            nextcloud_password="password",
         )
         assert basic_settings.enable_login_flow is False
         assert basic_settings.enable_multi_user_basic_auth is False