fix(auth): address PR #758 round-5 medium/low review

Three findings from the latest review on #758 (1 medium, 2 low):

Medium:
- browser_oauth_routes.oauth_logout: move delete_browser_session into a
  finally block so an error from delete_refresh_token can no longer leave
  an orphan browser_sessions row. The orphan was not exploitable
  (SessionAuthBackend rejects sessions without a live refresh token), but
  it lingered until the hourly cleanup cron — a correctness gap. New
  regression test pins the fix.

Low:
- oauth_callback_nextcloud: drop redundant ``or None`` from
  ``expected_nonce=nonce``. ``nonce`` is already ``str | None`` and
  ``secrets.token_urlsafe`` never produces an empty string, so the
  coercion was a no-op that could mislead future readers into thinking
  empty-string was a valid skip-the-check path.
- storage.RefreshTokenStorage.initialize: fail fast at startup when
  SQLite < 3.35, since ``DELETE ... RETURNING`` (used in
  ``delete_browser_session``) needs that minimum. Ubuntu 20.04 ships
  3.31 and would otherwise hit OperationalError on every logout.
  Prerequisite also documented in docs/installation.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud_mcp_server/auth/oauth_routes.py

@@ -647,15 +647,18 @@ async def oauth_callback_nextcloud(request: Request):
 
     # Verify ID token signature + claims (issue #626 finding 1).
     # ``expected_nonce`` is the per-request nonce stored on the
-    # oauth_session row (PR #758 round-3 finding 1); falsy → skip nonce
-    # check for sessions written before the column existed.
+    # oauth_session row (PR #758 round-3 finding 1). ``nonce`` is already
+    # ``str | None`` and ``secrets.token_urlsafe`` never produces an empty
+    # string, so passing it directly is correct — pre-migration-006 rows
+    # surface as ``None`` from ``oauth_session.get("nonce")``, which
+    # ``verify_id_token`` already treats as "skip the check".
     logger.info("oauth_callback_nextcloud: Verifying ID token")
     try:
         userinfo = await verify_id_token(
             id_token,
             discovery_url=discovery_url,
             expected_audience=mcp_server_client_id,
-            expected_nonce=nonce or None,
+            expected_nonce=nonce,
         )
     except IdTokenVerificationError as e:
         logger.error("ID token verification failed: %s", e)