fix: address PR #814 review + SonarCloud gate

SonarCloud:
- Resolve 6 S5332 hotspots (http→https in test fixture URLs).
- S6418: hoist the unauthenticated AsyncOpenAI placeholder to a named constant
  + NOSONAR (genuine non-secret; gateway ignores it when unauthenticated).
- Fix two reliability bugs: None-index guard in the gateway token-cache test
  (S2259) and float `> 0.0` instead of `!= 0.0` in the sentinel test (S1244).
- status.py idle path sleeps 0.1s instead of sleep(0) (S7491); NOSONAR on the
  protocol-required async no-await aclose() stubs (S7503).

Claude review:
- Remove three leftover debug print() calls in app.py (logger.info already
  covers them).
- payload_backfill: drop parsed_at from the backfilled-keys docstring (it is
  per-document state, not a deployment scalar); add a clean 404 precondition
  for BasicAuth deployments without an OAuth token verifier.
- status.py: task_status typed TaskStatus | None (drop type: ignore).
- nats.py: TODO to thread etags for file/deck/news; note etag default → None.
- factory: warn on unknown INGEST_BUS_URL scheme; raise ValueError instead of
  assert for the external-mode preconditions.
- docs/configuration.md: document the decomposition hook-point env vars + that
  nats-py ships core (lazy-imported) and external+bus uses two NATS connections.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/admin/payload_backfill.py

@@ -5,8 +5,10 @@ values for any *missing* decomposition payload keys (so existing corpora gain
 them without a re-index), then upserts the collection-metadata sentinel.
 
 Scope: this backfills the cheap, deployment-level scalar keys
-(``processor_version``, ``parsed_at``, ``pipeline_tier``, ``embedding_identity``)
-only. It deliberately does NOT synthesize ``acl_hash`` — a correct value needs
+(``processor_version``, ``pipeline_tier``, ``embedding_identity``) only.
+``parsed_at`` is per-document state (the local processor sets it at index time),
+not a deployment-level scalar, so it is intentionally not backfilled. It also
+deliberately does NOT synthesize ``acl_hash`` — a correct value needs
 per-document share enumeration (a separate job), and writing a placeholder
 ``acl_hash`` would be unsafe to pre-filter on. The query-side ACL pre-filter
 therefore stays disabled until a real ACL backfill runs (see
@@ -38,6 +40,14 @@ logger = logging.getLogger(__name__)
 
 
 async def handle_payload_backfill(request: Request) -> JSONResponse:
+    # require_admin_scope authenticates via the OAuth token verifier; in
+    # BasicAuth-only deployments there is no oauth_context, so surface a clean
+    # 404 rather than a confusing 401 from the broad except below.
+    if getattr(request.app.state, "oauth_context", None) is None:
+        return JSONResponse(
+            {"error": "admin API requires an OAuth-capable deployment"},
+            status_code=404,
+        )
     try:
         await require_admin_scope(request)
     except AdminScopeRequired: