feat: implement dynaconf configuration management (ADR-024 phases 1-3)

Replace ~80 manual os.getenv() calls in config.py with dynaconf-backed
configuration, enabling TOML file-based config alongside existing env
var support. Zero breaking changes — Settings dataclass interface and
all consumers unchanged.

Phase 1: Create settings.toml with all config keys and defaults,
.secrets.toml.example template, update .gitignore, initialize Dynaconf
instance with envvar_prefix=False and environment section switching.

Phase 2: Wire adapter — replace os.getenv() with _dynaconf.get() in
get_settings(), get_document_processor_config(), and deprecation/
dependency resolution helpers. Automatic type coercion eliminates ~30
manual int()/float()/.lower()=="true" patterns.

Phase 3: Add 12 declarative validators for port ranges, positive
integers, enum constraints, and float ranges. Remove redundant negative
overlap check from Settings.__post_init__.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/unit/test_ssl_config.py

@@ -9,7 +9,12 @@ import certifi
 import httpx
 import pytest
 
-from nextcloud_mcp_server.config import Settings, get_nextcloud_ssl_verify, get_settings
+from nextcloud_mcp_server.config import (
+    Settings,
+    _reload_config,
+    get_nextcloud_ssl_verify,
+    get_settings,
+)
 from nextcloud_mcp_server.http import nextcloud_httpx_client, nextcloud_httpx_transport
 
 
@@ -50,7 +55,7 @@ class TestGetNextcloudSSLVerify:
             "NEXTCLOUD_VERIFY_SSL": "true",
         }
         with patch.dict(os.environ, env, clear=False):
-            # Clear any cached settings
+            _reload_config()
             result = get_nextcloud_ssl_verify()
             assert result is True
 
@@ -110,12 +115,14 @@ class TestGetSettingsSSLEnvVars:
     def test_verify_ssl_env_true(self):
         env = {"NEXTCLOUD_VERIFY_SSL": "true"}
         with patch.dict(os.environ, env, clear=False):
+            _reload_config()
             settings = get_settings()
             assert settings.nextcloud_verify_ssl is True
 
     def test_verify_ssl_env_false(self):
         env = {"NEXTCLOUD_VERIFY_SSL": "false"}
         with patch.dict(os.environ, env, clear=False):
+            _reload_config()
             settings = get_settings()
             assert settings.nextcloud_verify_ssl is False
 
@@ -123,6 +130,7 @@ class TestGetSettingsSSLEnvVars:
         with patch.dict(os.environ, {}, clear=False):
             # Remove NEXTCLOUD_VERIFY_SSL if it exists
             os.environ.pop("NEXTCLOUD_VERIFY_SSL", None)
+            _reload_config()
             settings = get_settings()
             assert settings.nextcloud_verify_ssl is True
 
@@ -133,6 +141,7 @@ class TestGetSettingsSSLEnvVars:
         )
         env = {"NEXTCLOUD_CA_BUNDLE": str(ca_file)}
         with patch.dict(os.environ, env, clear=False):
+            _reload_config()
             settings = get_settings()
             assert settings.nextcloud_ca_bundle == str(ca_file)