refactor(webhooks): bound queue waits, route URLs through dynaconf

Addresses round-3 review feedback on PR #747:

- webhook_receiver: wrap send_stream.send() in anyio.fail_after(1.0)
  and return 503 with reason="queue full" if the queue is saturated.
  Avoids pinning the handler until NC's outbound timeout fires; the
  503 retry contract is the same as the existing "sync not running"
  branch.
- webhook_receiver: revise the compare_digest comment to match what
  the function actually guarantees — it avoids the per-character
  short-circuit of `==` but is not fully constant-time across length
  differences.
- _get_webhook_uri: read WEBHOOK_INTERNAL_URL and
  NEXTCLOUD_MCP_SERVER_URL via dynaconf so operators using
  settings.toml (rather than env vars) aren't silently routed into
  the docker/localhost fallback. Adds webhook_internal_url to
  Settings/_DEFAULTS/_field_map; nextcloud_mcp_server_url already
  existed. Docker-detection markers stay on os.getenv since they're
  container-runtime signals, not user-facing config.
- webhook_routes: sweep remaining f-string logger calls to lazy %s
  formatting per CLAUDE.md.
- client/webhooks: modernise full file's type hints to
  dict / list / | None per CLAUDE.md.

Tests:
- New test_returns_503_when_queue_is_full exercises the timeout
  branch with a saturated buffer and a shortened deadline.
- test_webhook_uri tests now patch get_settings (matching the
  auth-pair tests in the same file) instead of monkeypatching env
  vars directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config.py

@@ -57,6 +57,9 @@ _DEFAULTS: dict[str, Any] = {
     # tell NC to add `Authorization: Bearer <secret>` to webhook deliveries
     # and the receiver rejects unauthenticated requests.
     "webhook_secret": None,
+    # Internal URL override for webhook registration; wins over
+    # NEXTCLOUD_MCP_SERVER_URL when set (e.g. split internal/external URLs).
+    "webhook_internal_url": None,
     # Vector sync
     "vector_sync_scan_interval": 300,
     "vector_sync_processor_workers": 3,
@@ -440,6 +443,10 @@ class Settings:
     # delivery. When unset, registration uses authMethod="none" and the
     # receiver accepts unauthenticated POSTs (backward-compatible).
     webhook_secret: str | None = None
+    # Internal URL override for webhook registration. Highest-priority
+    # source for the URL we register with NC (above
+    # nextcloud_mcp_server_url and the docker-detection fallback).
+    webhook_internal_url: str | None = None
 
     # Vector sync settings (ADR-007)
     vector_sync_enabled: bool = False
@@ -780,6 +787,7 @@ def get_settings() -> Settings:
         "token_storage_db": "TOKEN_STORAGE_DB",
         # Webhook auth (ADR-010)
         "webhook_secret": "WEBHOOK_SECRET",
+        "webhook_internal_url": "WEBHOOK_INTERNAL_URL",
         # Vector sync settings (ADR-007)
         "vector_sync_scan_interval": "VECTOR_SYNC_SCAN_INTERVAL",
         "vector_sync_processor_workers": "VECTOR_SYNC_PROCESSOR_WORKERS",