fix(auth): use Settings for OIDC env vars in token revocation helper

After merging master, _should_use_secure_cookies was refactored to read
from Settings instead of os.getenv, which dropped `import os` from
browser_oauth_routes.py — leaving _revoke_refresh_token_at_idp's four
remaining os.getenv() calls undefined (CI ruff F821).

Migrate the helper to the same Settings-based pattern:
  - oidc_discovery_url     → settings.oidc_discovery_url
  - OIDC_CLIENT_ID         → settings.oidc_client_id
  - OIDC_CLIENT_SECRET     → settings.oidc_client_secret
  - NEXTCLOUD_HOST         → settings.nextcloud_host

Drive-by: the previous fallback read OIDC_CLIENT_ID, but the canonical
env var per env.sample / docker-compose is NEXTCLOUD_OIDC_CLIENT_ID.
The Settings layer handles this mapping via dynaconf, so the corrected
name is now used automatically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/browser_oauth_routes.py

@@ -641,11 +641,13 @@ async def _revoke_refresh_token_at_idp(oauth_ctx: dict, refresh_token: str) -> N
     # starlette_lifespan). A flat shape is also accepted for tests and
     # historical callers.
     cfg = oauth_ctx.get("config") or oauth_ctx
+    settings = get_settings()
     try:
-        discovery_url = cfg.get("discovery_url") or os.getenv(
-            "OIDC_DISCOVERY_URL",
-            f"{os.getenv('NEXTCLOUD_HOST', '')}/.well-known/openid-configuration",
-        )
+        discovery_url = cfg.get("discovery_url") or settings.oidc_discovery_url
+        if not discovery_url and settings.nextcloud_host:
+            discovery_url = (
+                f"{settings.nextcloud_host}/.well-known/openid-configuration"
+            )
         if not discovery_url:
             return
 
@@ -658,8 +660,8 @@ async def _revoke_refresh_token_at_idp(oauth_ctx: dict, refresh_token: str) -> N
                 logger.debug("IdP advertises no revocation_endpoint; skipping")
                 return
 
-            client_id = cfg.get("client_id") or os.getenv("OIDC_CLIENT_ID")
-            client_secret = cfg.get("client_secret") or os.getenv("OIDC_CLIENT_SECRET")
+            client_id = cfg.get("client_id") or settings.oidc_client_id
+            client_secret = cfg.get("client_secret") or settings.oidc_client_secret
             if not (client_id and client_secret):
                 logger.debug("No OIDC client credentials available for revocation")
                 return