fix(auth): login-flow provisioning — public login_url + session app passwords

Two fixes surfaced while testing Login Flow v2 provisioning behind a split
internal/external host (Docker: server↔Nextcloud over http://app, browser
over http://localhost:8080):

1. login_url pointed at the internal host. Nextcloud builds the login URL
   from the request host, so the browser-facing URL came back as
   http://app/login/v2/flow/... — unreachable from the user's browser. The
   poll endpoint was already rewritten to the internal host (correct, the
   server polls it); now LoginFlowV2Client also rewrites the login_url origin
   to settings.nextcloud_public_issuer_url when set (passed at all 5
   construction sites). When unset, behaviour is unchanged.

2. The app-password format guard rejected raw session tokens. core/
   getapppassword returns a long alphanumeric token, not the dashed 25-char
   Security-settings format, so the dashed-only regex 400'd the one-click
   opt-in handoff. Relax APP_PASSWORD_PATTERN to `^[a-zA-Z0-9-]{20,256}$`;
   the authoritative validation is still the BasicAuth check against Nextcloud.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/server/auth_tools.py

@@ -113,6 +113,7 @@ def register_auth_tools(mcp: FastMCP) -> None:
             flow_client = LoginFlowV2Client(
                 nextcloud_host=nextcloud_host,
                 verify_ssl=get_nextcloud_ssl_verify(),
+                public_host=settings.nextcloud_public_issuer_url,
             )
             init_response = await flow_client.initiate()
         except Exception as e:
@@ -258,6 +259,7 @@ def register_auth_tools(mcp: FastMCP) -> None:
             flow_client = LoginFlowV2Client(
                 nextcloud_host=nextcloud_host,
                 verify_ssl=get_nextcloud_ssl_verify(),
+                public_host=settings.nextcloud_public_issuer_url,
             )
             poll_result = await flow_client.poll(
                 poll_endpoint=session["poll_endpoint"],
@@ -431,6 +433,7 @@ def register_auth_tools(mcp: FastMCP) -> None:
             flow_client = LoginFlowV2Client(
                 nextcloud_host=nextcloud_host,
                 verify_ssl=get_nextcloud_ssl_verify(),
+                public_host=settings.nextcloud_public_issuer_url,
             )
             init_response = await flow_client.initiate()
         except Exception as e: