fix(storage): address PR #798 review feedback (credentials, asyncpg extra, TLS, pool)

Round-2 fixes after the bot review on PR #798 plus two user follow-ups
(self-signed Postgres support; asyncpg should be a PyPI extra). Folded
into the same PR rather than a follow-up since the work is still
unmerged.

Security
--------
- Mask database credentials in all 5 log call sites (storage.py × 4,
  migrations.py × 1) via a new `mask_db_password()` helper in config.py.
  Uses SQLAlchemy's `make_url(...).render_as_string(hide_password=True)`
  with a regex fallback so the masking path never raises.
- New `tests/unit/test_storage_logging.py` asserts a sentinel password
  never appears in `caplog` during `RefreshTokenStorage.initialize()`.

Distribution
------------
- `asyncpg` moved to `[project.optional-dependencies] postgres` so a
  vanilla `pip install nextcloud-mcp-server` no longer pulls in the
  ~5 MB C extension. The Docker image runs `uv sync --extra postgres`,
  so containerized deployments are unchanged.
- When `DATABASE_URL=postgresql+asyncpg://...` is set on a venv missing
  the extra, `RefreshTokenStorage.initialize()` raises a friendly
  RuntimeError pointing at `[postgres]` rather than the generic
  ModuleNotFoundError.

TLS for the Postgres backend
----------------------------
- New `DATABASE_VERIFY_SSL` + `DATABASE_CA_BUNDLE` env vars mirror the
  existing `NEXTCLOUD_VERIFY_SSL` / `NEXTCLOUD_CA_BUNDLE` pattern
  (validators in Settings.__post_init__, `get_database_ssl()` helper
  alongside `get_nextcloud_ssl_verify()`). `DATABASE_VERIFY_SSL=false`
  wins over `DATABASE_CA_BUNDLE` for incident-response convenience.
- Default is **None** rather than True — keeps PR #798's behavior
  intact for cluster-internal Postgres that runs without TLS. Operators
  opt into verify-full or supply a private CA. ADR-026 records the
  reasoning vs the Nextcloud HTTPS default.
- Engine factory in `storage.py` passes `ssl` via `connect_args` only
  when `get_database_ssl()` returns non-None; otherwise asyncpg's
  default (`prefer`) applies.
- Storage logs which TLS mode is active at INFO (no secret material).

Configurable connection pool
----------------------------
- `DATABASE_POOL_SIZE` (default 10) and `DATABASE_MAX_OVERFLOW`
  (default 20) replace the hardcoded engine values. With many replicas
  this can blow past managed-Postgres `max_connections=100`; tune down
  for large fleets.
- gte-1 / gte-0 validators in __post_init__ reject 0/negative pool
  sizes at startup with the offending value in the error.

Consistency polish
------------------
- Migration 006: convert raw `op.execute("ALTER TABLE ... ADD COLUMN")`
  to `op.batch_alter_table(...).add_column(sa.Column("nonce", sa.Text))`
  for stylistic consistency with the rewritten 001-005. Downgrade now
  drops the column instead of being a no-op.
- `registered_webhooks.created_at` standardized from `sa.Float` to
  `sa.BigInteger` (all other `*_at` columns); `store_webhook()` casts
  `time.time()` → `int`.
- `is_sqlite_url()` made case-insensitive.

Testing
-------
- New `tests/integration/test_storage_postgres.py::test_cleanup_expired_roundtrip`
  exercises `cleanup_expired_tokens`, `cleanup_expired_sessions`, and
  `cleanup_expired_browser_sessions` — relies on DELETE rowcount,
  historically dialect-tricky.
- `tests/unit/test_ssl_config.py` extended with `TestDatabaseSSLSettings`
  + `TestGetDatabaseSSL` classes (9 new tests) mirroring the existing
  Nextcloud SSL tests one-for-one.

Docs
----
- `docs/configuration.md` Centralized-Storage section grew the four new
  env vars + a homelab example with a private CA.
- `docs/ADR-026` grew Distribution, TLS, and `alembic/env.py` async-pattern
  subsections explaining the non-obvious design choices.

Helm chart counterpart in cbcoutinho/helm-charts PR #34 (separate
commit on `feat/nextcloud-mcp-server-database-url`).

Verification
------------
- `uv run pytest tests/unit/` — 1025 passed.
- `TEST_DATABASE_URL=... uv run pytest tests/integration/test_storage_postgres.py -m postgres` — 6 passed (including new cleanup test).
- `uv run ruff check && uv run ruff format --check && uv run ty check -- nextcloud_mcp_server` — clean.

Tracked on Astrolabe Cloud POC board, card #99.

---

_This PR was generated with the help of AI, and reviewed by a Human_

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/integration/test_storage_postgres.py

@@ -162,3 +162,59 @@ async def test_audit_log_capture(storage: RefreshTokenStorage):
     await storage.store_app_password(user_id="carol", app_password="x")
     logs = await storage.get_audit_logs(user_id="carol", limit=10)
     assert any(entry["event"] == "store_app_password" for entry in logs)
+
+
+async def test_cleanup_expired_roundtrip(storage: RefreshTokenStorage):
+    """``cleanup_expired_*`` paths rely on DELETE rowcount across dialects.
+
+    Regression guard for the bot review on PR #798 — the original
+    integration tests didn't exercise these methods, which historically
+    have been a source of dialect-portability bugs.
+    """
+    # Insert one fresh + one expired refresh token.
+    await storage.store_refresh_token(
+        user_id="fresh-user", refresh_token="fresh", expires_at=9_999_999_999
+    )
+    await storage.store_refresh_token(
+        user_id="expired-user", refresh_token="stale", expires_at=1
+    )
+
+    # Insert one fresh + one expired OAuth session.
+    await storage.store_oauth_session(
+        session_id="sess-fresh",
+        client_redirect_uri="http://localhost/cb",
+        mcp_authorization_code="code-fresh",
+        ttl_seconds=600,
+    )
+    await storage.store_oauth_session(
+        session_id="sess-stale",
+        client_redirect_uri="http://localhost/cb",
+        mcp_authorization_code="code-stale",
+        ttl_seconds=-3600,  # expires_at = now - 1h
+    )
+
+    # Insert one fresh + one expired browser session.
+    await storage.create_browser_session(
+        session_id="bs-fresh", user_id="alice", ttl_seconds=600
+    )
+    await storage.create_browser_session(
+        session_id="bs-stale", user_id="alice", ttl_seconds=-3600
+    )
+
+    tokens_deleted = await storage.cleanup_expired_tokens()
+    sessions_deleted = await storage.cleanup_expired_sessions()
+    browser_deleted = await storage.cleanup_expired_browser_sessions()
+
+    assert tokens_deleted == 1, f"expected 1 expired token, got {tokens_deleted}"
+    assert sessions_deleted == 1, (
+        f"expected 1 expired oauth session, got {sessions_deleted}"
+    )
+    assert browser_deleted == 1, (
+        f"expected 1 expired browser session, got {browser_deleted}"
+    )
+
+    # Fresh rows survived.
+    assert await storage.get_refresh_token("fresh-user") is not None
+    assert await storage.get_refresh_token("expired-user") is None
+    assert await storage.get_oauth_session("sess-fresh") is not None
+    assert await storage.get_oauth_session("sess-stale") is None