refactor: remove oauth profile, migrate MCP/OAuth tests to login-flow

Remove the oauth Docker Compose profile (mcp-oauth service, port 8001)
which used OAuth bearer tokens for direct NC API access, requiring
upstream OIDC patches. All NC access should use app passwords via
Login Flow v2 or BasicAuth.

Changes:
- Remove mcp-oauth service from docker-compose.yml
- Remove oauth mode from CI test matrix
- Delete oauth pass-through tests (core, permissions, token exchange)
- Delete oauth-specific tests (elicitation, NC PHP app, astrolabe)
- Migrate MCP/OAuth integration tests to login-flow profile:
  - DCR lifecycle, deletion, token type tests
  - Scope authorization (tool filtering) tests
  - Token introspection tests
- Fix flaky consent screen automation: replace JS btn.click() with
  Playwright native click + retry (handles Vue.js event binding race)
- Add scope-filtered OAuth client fixtures to login-flow conftest
- Keep keycloak profile for external IdP testing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/test.yml

@@ -42,7 +42,6 @@ jobs:
         mode:
           - "single-user"
           - "multi-user-basic"
-          - "oauth"
           - "login-flow"
         include:
           # Version-specific image pins — Renovate updates these via customManagers in renovate.json
@@ -58,7 +57,7 @@ jobs:
           # Mode-specific properties
           - mode: single-user
             profile: single-user
-            markers: "(smoke and not oauth and not keycloak and not login_flow and not multi_user_basic) or (integration and not oauth and not keycloak and not login_flow and not multi_user_basic)"
+            markers: "(smoke and not keycloak and not login_flow and not multi_user_basic) or (integration and not keycloak and not login_flow and not multi_user_basic)"
             wait-port: 8000
             mcp-internal-url: "http://mcp:8000"
             needs-playwright: false
@@ -74,14 +73,6 @@ jobs:
             needs-playwright: true
             extra-args: ""
 
-          - mode: oauth
-            profile: oauth
-            markers: "oauth and not keycloak"
-            wait-port: 8001
-            mcp-internal-url: "http://mcp-oauth:8001"
-            needs-playwright: true
-            extra-args: ""
-
           - mode: login-flow
             profile: login-flow
             markers: "login_flow"
@@ -184,7 +175,7 @@ jobs:
           echo "MCP service is ready on port ${{ matrix.wait-port }}."
 
       - name: Verify OIDC configuration
-        if: matrix.mode == 'oauth' || matrix.mode == 'login-flow'
+        if: matrix.mode == 'login-flow'
         run: |
           echo "=== OIDC Discovery ==="
           curl -s http://localhost:8080/.well-known/openid-configuration | jq .