fix(auth): make provision/revoke consistent with the app-password store

The OAuth provisioning tools (check_provisioning_status, revoke_nextcloud_
access) only consulted the refresh-token store + Astrolabe status, ignoring the
app_passwords store that Login Flow v2 (nc_auth_provision_access) and the
management API write to — the same store require_provisioning / get_client use
to grant tool access. Result: status reported "not provisioned" while tools
worked, and revoke said "nothing to revoke" while the credential persisted.

- _get_provisioning_status: also check storage.get_app_password_with_scopes,
  reporting is_provisioned with credential_type=app_password,
  flow_type=login_flow_v2.
- _revoke_nextcloud_access: when the credential is an app password, delete it
  from storage + invalidate the scope cache (no IdP token to revoke);
  refresh-token revocation via the Token Broker is unchanged.
- tests/unit/test_oauth_tools_app_password_provisioning.py: cover status +
  revoke for the app-password path.
- bump astrolabe submodule (deprovision MCP on disable); fix a stale assertion
  in the migrated bg-sync test (one-click flow has no separate app-password
  generation step).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_astrolabe_multi_user_background_sync.py

@@ -446,9 +446,6 @@ async def test_multi_user_astrolabe_background_sync_enablement(
         assert result["settings_accessed"], (
             f"{username} could not access Astrolabe settings"
         )
-        assert result["app_password_generated"], (
-            f"{username} app password was not generated"
-        )
         assert result["sync_enabled"], (
             f"{username} background sync enablement did not complete successfully"
         )

tests/unit/test_oauth_tools_app_password_provisioning.py

@@ -0,0 +1,92 @@
+"""Unit tests for app-password-store awareness in the provisioning tools.
+
+Login Flow v2 (nc_auth_provision_access) and the management app-password API
+write the credential to this server's ``app_passwords`` store — the same store
+``require_provisioning``/``get_client`` use to grant tool access. The OAuth
+provisioning tools (check_provisioning_status / revoke_nextcloud_access) must
+read and clear that store too, otherwise they report "not provisioned" while
+tools still work, and "nothing to revoke" while the credential persists.
+"""
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from nextcloud_mcp_server.server import oauth_tools
+from nextcloud_mcp_server.server.oauth_tools import (
+    _get_provisioning_status,
+    _revoke_nextcloud_access,
+)
+
+pytestmark = pytest.mark.unit
+
+
+@pytest.fixture
+def _no_astrolabe_settings(mocker):
+    """Disable the astrolabe-status branch so the app_passwords store is hit."""
+    mocker.patch.object(
+        oauth_tools,
+        "get_settings",
+        return_value=SimpleNamespace(oidc_client_id=None, oidc_client_secret=None),
+    )
+
+
+async def test_status_reports_provisioned_for_app_password_store(
+    mocker, _no_astrolabe_settings
+):
+    """A Login Flow v2 app password in storage => is_provisioned with the
+    app_password credential type (was previously reported as not provisioned)."""
+    storage = MagicMock()
+    storage.get_app_password_with_scopes = AsyncMock(
+        return_value={"app_password": "tok", "scopes": ["notes.read"]}
+    )
+    storage.get_refresh_token = AsyncMock(return_value=None)
+    mocker.patch.object(
+        oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
+    )
+
+    status = await _get_provisioning_status(MagicMock(), "tester")
+
+    assert status.is_provisioned is True
+    assert status.credential_type == "app_password"
+    assert status.flow_type == "login_flow_v2"
+    assert status.scopes == ["notes.read"]
+    storage.get_refresh_token.assert_not_awaited()  # app password short-circuits
+
+
+async def test_revoke_deletes_app_password(mocker, _no_astrolabe_settings):
+    """Revoke must delete the app password from storage (not just refresh tokens)."""
+    storage = MagicMock()
+    storage.get_app_password_with_scopes = AsyncMock(
+        return_value={"app_password": "tok", "scopes": None}
+    )
+    storage.get_refresh_token = AsyncMock(return_value=None)
+    storage.delete_app_password = AsyncMock(return_value=True)
+    mocker.patch.object(
+        oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
+    )
+    mocker.patch.object(oauth_tools, "invalidate_scope_cache")
+
+    result = await _revoke_nextcloud_access(MagicMock(), "tester")
+
+    assert result.success is True
+    storage.delete_app_password.assert_awaited_once_with("tester")
+    oauth_tools.invalidate_scope_cache.assert_called_once_with("tester")
+
+
+async def test_revoke_noop_when_nothing_provisioned(mocker, _no_astrolabe_settings):
+    """No credential of any kind => graceful no-op, no deletion attempted."""
+    storage = MagicMock()
+    storage.get_app_password_with_scopes = AsyncMock(return_value=None)
+    storage.get_refresh_token = AsyncMock(return_value=None)
+    storage.delete_app_password = AsyncMock()
+    mocker.patch.object(
+        oauth_tools, "get_shared_storage", AsyncMock(return_value=storage)
+    )
+
+    result = await _revoke_nextcloud_access(MagicMock(), "tester")
+
+    assert result.success is True
+    assert "No Nextcloud access to revoke" in result.message
+    storage.delete_app_password.assert_not_awaited()