feat: Split read/write scopes into app:read/write scopes

docker-compose.yml

@@ -66,7 +66,7 @@ services:
 
   mcp-oauth:
     build: .
-    command: ["--transport", "streamable-http", "--oauth", "--port", "8001"]
+    command: ["--transport", "streamable-http", "--oauth", "--port", "8001", "--oauth-token-type", "jwt"]
     restart: always
     depends_on:
       - app
@@ -77,34 +77,14 @@ services:
       - NEXTCLOUD_MCP_SERVER_URL=http://localhost:8001
       - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
       - NEXTCLOUD_OIDC_CLIENT_STORAGE=/app/.oauth/nextcloud_oauth_client.json
-      - NEXTCLOUD_OIDC_SCOPES=openid profile email nc:read nc:write
+      - NEXTCLOUD_OIDC_SCOPES=openid profile email notes:read notes:write calendar:read calendar:write contacts:read contacts:write cookbook:read cookbook:write deck:read deck:write tables:read tables:write files:read files:write sharing:read sharing:write todo:read todo:write
       # No USERNAME/PASSWORD - will use OAuth with Dynamic Client Registration
       # Client credentials will be registered and stored in volume on first startup
+      # JWT token type is used for testing (faster validation, scopes embedded in token)
     volumes:
       - oauth-client-storage:/app/.oauth
 
-  mcp-oauth-jwt:
-    build: .
-    command: ["--transport", "streamable-http", "--oauth", "--port", "8002"]
-    restart: always
-    depends_on:
-      - app
-    ports:
-      - 127.0.0.1:8002:8002
-    environment:
-      - NEXTCLOUD_HOST=http://app:80
-      - NEXTCLOUD_MCP_SERVER_URL=http://localhost:8002
-      - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
-      - NEXTCLOUD_OIDC_CLIENT_STORAGE=/app/.oauth-jwt/nextcloud_oauth_client.json
-      - NEXTCLOUD_OIDC_SCOPES=openid profile email nc:read nc:write
-      - NEXTCLOUD_OIDC_TOKEN_TYPE=jwt
-      # No USERNAME/PASSWORD - will use OAuth with Dynamic Client Registration (DCR)
-      # Client will be registered with token_type=JWT on first startup
-    volumes:
-      - oauth-jwt-client-storage:/app/.oauth-jwt
-
 volumes:
   nextcloud:
   db:
   oauth-client-storage:
-  oauth-jwt-client-storage: