fix: address second round of PR review for scope prefix

- Use dynaconf (get_settings()) instead of os.getenv for OIDC_RESOURCE_SERVER_ID
- Re-add Settings field, _field_map entry, and settings.toml default
- Add trailing-slash guard (.rstrip("/")) to prevent double-slash in scopes
- Add double-prefixing guard: skip scopes already carrying the prefix
- Add @pytest.mark.unit to test module
- Add test for already-prefixed scopes
- Document OIDC_RESOURCE_SERVER_ID in docs/configuration.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/unit/test_scope_prefix.py

@@ -4,6 +4,8 @@ import pytest
 
 from nextcloud_mcp_server.auth.oauth_routes import _transform_scopes_for_idp
 
+pytestmark = pytest.mark.unit
+
 
 class TestTransformScopesForIdp:
     """Test _transform_scopes_for_idp scope transformation."""
@@ -70,3 +72,13 @@ class TestTransformScopesForIdp:
         """An empty scopes string returns empty."""
         result = _transform_scopes_for_idp("", "https://api.example.com")
         assert result == ""
+
+    def test_already_prefixed_scopes_not_double_prefixed(self):
+        """Scopes already carrying the resource server prefix are not prefixed again."""
+        result = _transform_scopes_for_idp(
+            "https://api.example.com/notes.read notes.write",
+            "https://api.example.com",
+        )
+        assert result == (
+            "https://api.example.com/notes.read https://api.example.com/notes.write"
+        )