fix: address review feedback — security, caching, CI 429 retry

- Add 429 retry with exponential backoff to register_client() (fixes CI
  oauth matrix failures from parallel DCR requests)
- Make client_id, redirect_uri, and PKCE mandatory at token endpoint
- Add null-checks for discovery_url and OAuth credentials in proxy flows
- Add OIDC discovery document caching with 5-min TTL
- Add per-IP rate limiting on /oauth/register DCR proxy
- Discover DCR endpoint from OIDC discovery instead of hardcoding
- Extract extract_user_id_from_token to auth/token_utils.py (breaks
  circular imports between server/ and auth/ layers)
- Add TTL scope cache in scope_authorization.py (avoids DB hit per tool)
- Add defense-in-depth scope validation in storage layer
- Broaden elicitation exception handling with graceful fallback
- Add idempotentHint to nc_auth_check_status, return "pending" status
  after accepted elicitation, add polling interval to description
- Change ALL_SUPPORTED_SCOPES from tuple to frozenset for O(1) lookups
- Replace Optional[str] with str | None throughout config.py
- Use default_factory for ProxyCodeEntry/ASProxySession dataclasses
- Add proxy code/session cleanup to background loop
- Fix OIDC verification CI step to only run for oauth/login-flow modes
- Add unit tests for access.py REST endpoints (10 tests)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nextcloud_mcp_server/server/auth_tools.py

@@ -16,6 +16,7 @@ from nextcloud_mcp_server.auth.elicitation import present_login_url
 from nextcloud_mcp_server.auth.login_flow import LoginFlowV2Client
 from nextcloud_mcp_server.auth.scope_authorization import require_scopes
 from nextcloud_mcp_server.auth.storage import get_shared_storage
+from nextcloud_mcp_server.auth.token_utils import extract_user_id_from_token
 from nextcloud_mcp_server.config import get_nextcloud_ssl_verify, get_settings
 from nextcloud_mcp_server.models.auth import (
     ALL_SUPPORTED_SCOPES,
@@ -23,7 +24,6 @@ from nextcloud_mcp_server.models.auth import (
     ProvisionStatusResponse,
     UpdateScopesResponse,
 )
-from nextcloud_mcp_server.server.oauth_tools import extract_user_id_from_token
 
 logger = logging.getLogger(__name__)
 
@@ -92,7 +92,7 @@ def register_auth_tools(mcp: FastMCP) -> None:
             return ProvisionAccessResponse(
                 status="error",
                 message=f"Invalid scopes: {', '.join(invalid_scopes)}. "
-                f"Valid scopes: {', '.join(ALL_SUPPORTED_SCOPES)}",
+                f"Valid scopes: {', '.join(sorted(ALL_SUPPORTED_SCOPES))}",
                 success=False,
             )
 
@@ -160,6 +160,13 @@ def register_auth_tools(mcp: FastMCP) -> None:
                 "Login acknowledged. Call nc_auth_check_status to verify "
                 "and complete provisioning."
             )
+            return ProvisionAccessResponse(
+                status="pending",
+                login_url=init_response.login_url,
+                message=message,
+                user_id=user_id,
+                requested_scopes=requested_scopes,
+            )
 
         return ProvisionAccessResponse(
             status="login_required",
@@ -174,10 +181,12 @@ def register_auth_tools(mcp: FastMCP) -> None:
         title="Check Nextcloud Access Status",
         description=(
             "Check if Nextcloud access has been provisioned. "
-            "If a Login Flow is pending, this will poll for completion."
+            "If a Login Flow is pending, this will poll for completion. "
+            "Recommended polling interval: 5 seconds."
         ),
         annotations=ToolAnnotations(
             readOnlyHint=True,
+            idempotentHint=True,
             openWorldHint=True,
         ),
     )