fix(oauth): follow redirects when fetching OIDC discovery

Nextcloud installs without pretty URLs return a 301 from
`/.well-known/openid-configuration` to
`/index.php/.well-known/openid-configuration` (e.g. Hetzner StorageShare).
`_get_cached_discovery` did not enable follow_redirects, so httpx raised
HTTPStatusError on the 301 and the AS-proxy authorize handler returned
500, breaking client connections (e.g. claude.ai).

Pass `follow_redirects=True` to the httpx client used for the discovery
fetch only — downstream OIDC endpoints (token, userinfo, etc.) are
absolute URLs read from the discovery doc and are unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/oauth_routes.py

@@ -136,13 +136,18 @@ def _transform_scopes_for_idp(scopes: str, resource_server_id: str) -> str:
 
 
 async def _get_cached_discovery(url: str) -> dict[str, Any]:
-    """Fetch OIDC discovery document with caching (5-minute TTL)."""
+    """Fetch OIDC discovery document with caching (5-minute TTL).
+
+    Follows redirects so the configured discovery URL works against Nextcloud
+    instances without pretty URLs enabled, where ``/.well-known/openid-configuration``
+    issues a 301 to ``/index.php/.well-known/openid-configuration``.
+    """
     now = time.time()
     if url in _discovery_cache:
         expires_at, data = _discovery_cache[url]
         if now < expires_at:
             return data
-    async with nextcloud_httpx_client() as http_client:
+    async with nextcloud_httpx_client(follow_redirects=True) as http_client:
         response = await http_client.get(url)
         response.raise_for_status()
         data = response.json()