fix(auth): address PR #758 round-4 review

Seven findings from the latest review on #758 (3 medium, 4 low/nit):

Medium:
- storage.py: replace 5 ``assert self.cipher is not None`` sites with
  explicit ``RuntimeError`` so missing TOKEN_ENCRYPTION_KEY can't silently
  become an AttributeError under ``python -O``
- session_backend.py: document the silent-invalidation invariant —
  refresh-token TTL expiry without explicit logout deliberately makes
  the browser session unusable; future readers must not relax it
- server/oauth_tools.py: drop user_id from the Flow 2 session_id
  identifier — use ``flow2_{secrets.token_hex(16)}`` so audit logs and
  DB rows don't carry user_id in the session_id field

Low / nit:
- token_utils.py: drop _fetch_locks dict entry in finally so a probed
  deployment can't grow the lock dict without bound; coalescing test
  now pins the invariant with len(_fetch_locks) == 0
- browser_oauth_routes.py: strip trailing slash from settings.nextcloud_host
  before constructing the well-known URL so a host configured as
  ``https://cloud.example.com/`` doesn't produce a double-slash
- browser_oauth_routes.py: add comment explaining the three-layer CSRF
  policy on the mcp_session cookie set (SameSite=Lax + POST-only logout
  + Origin/Referer check)
- oauth_routes.py: convert all 23 f-string log calls to lazy %-style
  per the CLAUDE.md / memory feedback_lazy_logging convention

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/session_backend.py

@@ -22,6 +22,18 @@ class SessionAuthBackend(AuthenticationBackend):
 
     For BasicAuth mode: Always authenticates as the configured user.
     For OAuth mode: Checks for valid session cookie with stored refresh token.
+
+    Behavior note — silent invalidation on refresh-token TTL expiry:
+        The OAuth path requires *both* a live ``browser_sessions`` row and a
+        live ``refresh_tokens`` row for the resolved user. Logout deletes
+        both atomically, so a logged-out user always fails closed here.
+        However, if the refresh token expires by TTL (without an explicit
+        logout) the row is removed by ``get_refresh_token`` and the browser
+        session becomes unusable — the user simply gets redirected to
+        ``/oauth/login``. This is intentional defense-in-depth: the
+        refresh-token check is what makes a leaked or stale browser cookie
+        unusable after revocation. Do not relax this without first removing
+        the cleanup invariant on logout (PR #758 round-4 review medium 2).
     """
 
     def __init__(self, oauth_enabled: bool = False):