feat: add OIDC resource server scope prefix for Cognito compatibility

When OIDC_RESOURCE_SERVER_ID is set, prefix resource scopes with the
identifier when forwarding to the IdP (e.g., calendar.read becomes
https://example.com/calendar.read). Required for IdPs like AWS Cognito
that mandate {resource_server_id}/{scope} format for custom scopes.
OIDC standard scopes (openid, profile, email) are forwarded as-is.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/config.py

@@ -213,6 +213,7 @@ class Settings:
     oidc_client_id: str | None = None
     oidc_client_secret: str | None = None
     oidc_issuer: str | None = None
+    oidc_resource_server_id: str | None = None
 
     # Nextcloud settings
     nextcloud_host: str | None = None
@@ -568,6 +569,7 @@ def get_settings() -> Settings:
         "oidc_client_id": "NEXTCLOUD_OIDC_CLIENT_ID",
         "oidc_client_secret": "NEXTCLOUD_OIDC_CLIENT_SECRET",
         "oidc_issuer": "OIDC_ISSUER",
+        "oidc_resource_server_id": "OIDC_RESOURCE_SERVER_ID",
         # Nextcloud settings
         "nextcloud_host": "NEXTCLOUD_HOST",
         "nextcloud_username": "NEXTCLOUD_USERNAME",