docs(adr-022): mark Accepted, update env/compose/migration docs for LOGIN_FLOW rename

Follow-up to the LOGIN_FLOW rename. The user-facing surface area —
env.sample, docker-compose.yml mcp-login-flow profile, migration
guide, ADR statuses, and the running.md boot-log examples — all need
to refer to `login_flow` rather than the deprecated
`oauth_single_audience` string.

- docker-compose.yml: add explicit MCP_DEPLOYMENT_MODE=login_flow to
  the mcp-login-flow profile (no longer relying on auto-detection).
- env.sample: update the deployment-mode list and example, dropping
  the removed `oauth_token_exchange` and pointing at ADR-022 for the
  rename rationale.
- docs/ADR-022: flip Status to Accepted with a note that this PR
  implements step 1 (rename + validation gate).
- docs/ADR-021: note that it has been partly superseded by ADR-022
  (the oauth_single_audience naming is no longer accurate); cross-link.
- docs/ADR-025: drop oauth_single_audience/keycloak from the dynaconf
  validator example and the [oauth_single_audience] TOML section.
- docs/configuration-migration-v2.md: bulk-replace oauth_single_audience
  → login_flow throughout (sed -i).
- docs/running.md: re-collapse the per-mode boot-log subsections (added
  during the closed PR #786 workaround) back into a uniform
  "<mode>"-substitution block — now correct after this PR's logging
  cleanup at app.py:1172.

No code changes in this commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ADR-025-dynaconf-configuration-management.md

@@ -108,8 +108,9 @@ nextcloud_verify_ssl = true
 nextcloud_ca_bundle = "@none"
 
 # === Deployment Mode ===
-# Auto-detected if not set. Valid: single_user_basic, multi_user_basic,
-# oauth_single_audience, login_flow, keycloak
+# Auto-detected if not set. Valid: single_user_basic, multi_user_basic, login_flow
+# (`oauth_single_audience` was renamed to `login_flow` in ADR-022; `keycloak`
+# is a planned future mode.)
 # mcp_deployment_mode = ""
 
 # === Authentication Toggles ===
@@ -209,7 +210,7 @@ enable_token_exchange = true
 token_storage_db = "/app/data/tokens.db"
 token_exchange_cache_ttl = 300
 
-[oauth_single_audience]
+[login_flow]
 token_storage_db = "/app/data/tokens.db"
 ```
 
@@ -281,7 +282,6 @@ validators = [
     # Deployment mode validation — catch typos at startup
     Validator("MCP_DEPLOYMENT_MODE", is_in=[
         "single_user_basic", "multi_user_basic", "login_flow",
-        "keycloak", "oauth_single_audience",
     ], when=Validator("MCP_DEPLOYMENT_MODE", must_exist=True)),
 
     # Type and range validation