refactor: Update JWT client to use DCR, re-enable tool filtering

docker-compose.yml

@@ -92,21 +92,19 @@ services:
     ports:
       - 127.0.0.1:8002:8002
     environment:
-      #- NEXTCLOUD_HOST=http://app:80
-      - NEXTCLOUD_HOST=http://host.docker.internal:8080
+      - NEXTCLOUD_HOST=http://app:80
       - NEXTCLOUD_MCP_SERVER_URL=http://127.0.0.1:8002
-      - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
-      - NEXTCLOUD_OIDC_CLIENT_STORAGE=/var/www/html/.oauth-jwt/nextcloud_oauth_client.json
+      - NEXTCLOUD_PUBLIC_ISSUER_URL=http://127.0.0.1:8080
+      - NEXTCLOUD_OIDC_CLIENT_STORAGE=/app/.oauth-jwt/nextcloud_oauth_client.json
       - NEXTCLOUD_OIDC_SCOPES=openid profile email nc:read nc:write
-      # No USERNAME/PASSWORD - will use OAuth with JWT tokens
-      # Client credentials auto-generated by app container post-installation hook
+      - NEXTCLOUD_OIDC_TOKEN_TYPE=jwt
+      # No USERNAME/PASSWORD - will use OAuth with Dynamic Client Registration (DCR)
+      # Client will be registered with token_type=JWT on first startup
     volumes:
-      # NOTE: JWT-enabled OIDC client credentials created during nextcloud installation scripts
-      - nextcloud:/var/www/html:ro
-    extra_hosts:
-      - host.docker.internal:host-gateway
+      - oauth-jwt-client-storage:/app/.oauth-jwt
 
 volumes:
   nextcloud:
   db:
   oauth-client-storage:
+  oauth-jwt-client-storage: