docs(adr-022): mark Accepted, update env/compose/migration docs for LOGIN_FLOW rename

Follow-up to the LOGIN_FLOW rename. The user-facing surface area —
env.sample, docker-compose.yml mcp-login-flow profile, migration
guide, ADR statuses, and the running.md boot-log examples — all need
to refer to `login_flow` rather than the deprecated
`oauth_single_audience` string.

- docker-compose.yml: add explicit MCP_DEPLOYMENT_MODE=login_flow to
  the mcp-login-flow profile (no longer relying on auto-detection).
- env.sample: update the deployment-mode list and example, dropping
  the removed `oauth_token_exchange` and pointing at ADR-022 for the
  rename rationale.
- docs/ADR-022: flip Status to Accepted with a note that this PR
  implements step 1 (rename + validation gate).
- docs/ADR-021: note that it has been partly superseded by ADR-022
  (the oauth_single_audience naming is no longer accurate); cross-link.
- docs/ADR-025: drop oauth_single_audience/keycloak from the dynaconf
  validator example and the [oauth_single_audience] TOML section.
- docs/configuration-migration-v2.md: bulk-replace oauth_single_audience
  → login_flow throughout (sed -i).
- docs/running.md: re-collapse the per-mode boot-log subsections (added
  during the closed PR #786 workaround) back into a uniform
  "<mode>"-substitution block — now correct after this PR's logging
  cleanup at app.py:1172.

No code changes in this commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

env.sample

@@ -3,11 +3,15 @@
 # ============================================
 # Optional: Explicitly declare deployment mode (ADR-021)
 # If not set, mode is auto-detected from other settings
-# Valid values: single_user_basic, multi_user_basic, oauth_single_audience,
-#               oauth_token_exchange
+# Valid values: single_user_basic, multi_user_basic, login_flow
+#
+# Note: `login_flow` is the renamed successor of the former
+# `oauth_single_audience` mode (see ADR-022). The un-augmented OAuth path
+# required unmerged Nextcloud user_oidc patches and is no longer supported;
+# `login_flow` mode now requires ENABLE_LOGIN_FLOW=true.
 #
 # Recommendation: Set this for clarity and to catch configuration errors early
-#MCP_DEPLOYMENT_MODE=oauth_single_audience
+#MCP_DEPLOYMENT_MODE=login_flow
 
 # ============================================
 # COMMON SETTINGS (Required for all modes)