fix: address PR #814 review + SonarCloud gate

SonarCloud:
- Resolve 6 S5332 hotspots (http→https in test fixture URLs).
- S6418: hoist the unauthenticated AsyncOpenAI placeholder to a named constant
  + NOSONAR (genuine non-secret; gateway ignores it when unauthenticated).
- Fix two reliability bugs: None-index guard in the gateway token-cache test
  (S2259) and float `> 0.0` instead of `!= 0.0` in the sentinel test (S1244).
- status.py idle path sleeps 0.1s instead of sleep(0) (S7491); NOSONAR on the
  protocol-required async no-await aclose() stubs (S7503).

Claude review:
- Remove three leftover debug print() calls in app.py (logger.info already
  covers them).
- payload_backfill: drop parsed_at from the backfilled-keys docstring (it is
  per-document state, not a deployment scalar); add a clean 404 precondition
  for BasicAuth deployments without an OAuth token verifier.
- status.py: task_status typed TaskStatus | None (drop type: ignore).
- nats.py: TODO to thread etags for file/deck/news; note etag default → None.
- factory: warn on unknown INGEST_BUS_URL scheme; raise ValueError instead of
  assert for the external-mode preconditions.
- docs/configuration.md: document the decomposition hook-point env vars + that
  nats-py ships core (lazy-imported) and external+bus uses two NATS connections.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/vector/queue/factory.py

@@ -9,16 +9,25 @@ later) so moving the external processor to Postgres needs no new INGEST_MODE.
 
 from __future__ import annotations
 
+import logging
 from urllib.parse import urlsplit
 
 from ...config import Settings
 from .ports import TaskProducer
 
+logger = logging.getLogger(__name__)
+
 
 def _transport_for(url: str) -> str:
     scheme = urlsplit(url).scheme.lower()
     if scheme.startswith("postgres"):
         return "postgres"
+    if not scheme.startswith("nats"):
+        logger.warning(
+            "INGEST_BUS_URL scheme %r is neither nats:// nor postgres://; "
+            "defaulting to the NATS transport",
+            scheme,
+        )
     return "nats"
 
 
@@ -28,8 +37,13 @@ async def build_external_producer(settings: Settings) -> TaskProducer:
     Precondition: ``settings.ingest_mode == "external"`` (so __post_init__ has
     guaranteed ``ingest_bus_url`` and ``tenant_id`` are set).
     """
-    assert settings.ingest_bus_url is not None
-    assert settings.tenant_id is not None
+    # Defence-in-depth (robust under ``python -O``, which strips asserts):
+    # __post_init__ already guarantees these when ingest_mode == external.
+    if settings.ingest_bus_url is None or settings.tenant_id is None:
+        raise ValueError(
+            "build_external_producer requires INGEST_BUS_URL and TENANT_ID "
+            "(guaranteed by Settings validation when INGEST_MODE=external)"
+        )
 
     transport = _transport_for(settings.ingest_bus_url)
     if transport == "postgres":

nextcloud_mcp_server/vector/queue/nats.py

@@ -36,7 +36,13 @@ def _modified_at_rfc3339(modified_at: int) -> str:
 
 def _content_hash(task: DocumentTask) -> str:
     """etag is the change-detection token; fall back to modified_at when it is
-    absent (e.g. deletes, or sources whose etag we don't thread through)."""
+    absent (e.g. deletes, or sources whose etag we don't thread through).
+
+    TODO(follow-up): thread etags for file / deck_card / news_item scans too
+    (only note scans pass etag today). Until then their JetStream Nats-Msg-Id
+    dedup keys off modified_at, which misses content changes that leave
+    modified_at unchanged (e.g. a file move/rename).
+    """
     return task.etag or str(task.modified_at)
 
 
@@ -133,7 +139,7 @@ class NatsTaskProducer:
     ) -> None:
         return None
 
-    async def aclose(self) -> None:
+    async def aclose(self) -> None:  # NOSONAR: async required by TaskProducer protocol
         # Per-handle close (e.g. a per-user scanner clone exiting). The bus
         # connection is shared and owned by the lifespan, so this is a no-op;
         # the connection is torn down once via ``drain()`` on shutdown.

nextcloud_mcp_server/vector/queue/postgres.py

@@ -45,5 +45,5 @@ class PostgresTaskProducer:
     ) -> None:  # pragma: no cover
         return None
 
-    async def aclose(self) -> None:  # pragma: no cover
+    async def aclose(self) -> None:  # pragma: no cover  # NOSONAR: protocol stub
         return None

nextcloud_mcp_server/vector/queue/status.py

@@ -134,7 +134,7 @@ class NatsStatusSubscriber:
         self,
         shutdown_event: anyio.Event,
         *,
-        task_status: TaskStatus = None,  # type: ignore[assignment]
+        task_status: TaskStatus | None = None,
     ) -> None:
         """Durable pull-consumer loop. Requires a live broker (integration)."""
         import anyio  # noqa: PLC0415
@@ -149,8 +149,9 @@ class NatsStatusSubscriber:
             try:
                 msgs = await sub.fetch(batch=16, timeout=5)
             except Exception:
-                # fetch timeout when idle — loop and re-check shutdown.
-                await anyio.sleep(0)
+                # fetch timeout when idle — brief pause before re-checking
+                # shutdown, avoiding a tight check-and-sleep spin on quiet tenants.
+                await anyio.sleep(0.1)
                 continue
             for msg in msgs:
                 self.handle_message(msg.subject, msg.data)