docs: clear review-round-3 nits — stale login_flow_v2, duplicates, field comments

Five small findings from the reviewer's third round, plus a SonarCloud
quality-gate failure on a test fixture.

- docs/troubleshooting.md, docs/configuration.md: six pre-PR references
  to a non-existent `login_flow_v2` mode value (the actual enum value is
  `login_flow`). They predated this PR but became actively misleading
  once `detect_auth_mode` started raising ValueError for anything not in
  the mode_map. Replaced with `login_flow` via sed.
- docs/configuration-migration-v2.md: removed a duplicate
  `MCP_DEPLOYMENT_MODE=multi_user_basic` line in the troubleshooting
  section (around line 447) — same shape as the round-2 duplicate
  caught earlier in the migration-steps section. Also dropped the
  `oauth_token_exchange` row from the mode-value table around line 364
  (that enum value was removed in 57303135 and would now raise
  ValueError from detect_auth_mode).
- nextcloud_mcp_server/config.py: field comments for
  `enable_multi_user_basic_auth` and `enable_login_flow` said
  "Auto-set by detect_auth_mode()" but the derivation moved into
  `Settings.__post_init__` in the previous commit. Updated both.
- tests/unit/test_config_validators.py: SonarCloud's python:S2068
  flagged `nextcloud_password="hunter2"` in the
  `test_login_flow_mode_auto_derives_enable_login_flow_flag` fixture I
  added in commit 5 as a potentially hard-coded credential. Other
  fixtures in the same file use the literal `"password"` and aren't
  flagged (they predate the PR and SonarCloud only checks new-code).
  Switched to `"password"` to match the existing convention.

No functional changes; all 1009 unit tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config.py

@@ -456,14 +456,14 @@ class Settings:
     # Multi-user BasicAuth pass-through mode (ADR-019 interim solution).
     # Internal — not user-settable; the ENABLE_MULTI_USER_BASIC_AUTH env-var
     # alias was removed in the ADR-022 follow-up. Auto-set by
-    # detect_auth_mode() when MCP_DEPLOYMENT_MODE=multi_user_basic. When True,
+    # Settings.__post_init__ when MCP_DEPLOYMENT_MODE=multi_user_basic. When True,
     # the MCP server extracts BasicAuth credentials from request headers and
     # passes them through to Nextcloud APIs (no storage, stateless). Kept
     # as a field for backward compat with the runtime call sites that read it.
     enable_multi_user_basic_auth: bool = False
 
     # Login Flow v2 derived flag (ADR-022). Internal — not user-settable.
-    # Auto-set by detect_auth_mode() when the resolved deployment mode is
+    # Auto-set by Settings.__post_init__ when the resolved deployment mode is
     # LOGIN_FLOW. Kept as a field for backward compat with the runtime call
     # sites that read it (app.py, context.py, scope_authorization.py).
     enable_login_flow: bool = False