fix(login-flow): allow Astrolabe's OAuth client on the management API

The `mcp-login-flow` profile's `ALLOWED_MGMT_CLIENT` was set to the
test-fixture id `nextcloudMcpServerUIPublicClient` only, but the actual
Astrolabe app provisions its OIDC client as
`astrolabeMcpClientOAuth00000000000` (see
`app-hooks/before-starting/26-configure-astrolabe-oauth.sh:39`). All
tokens issued through the "Enable Semantic Search" flow were rejected
with HTTP 401 by `unified_verifier.py:222-227`'s allowlist check, and
the Astrolabe UI's retry loop subsequently exhausted the
`api/passwords.py` 5/hr rate limit (HTTP 429).

Switch the `mcp-login-flow` allowlist to Astrolabe's client id so
production-shaped traffic actually validates. The `mcp-multi-user-basic`
profile keeps `nextcloudMcpServerUIPublicClient` for the
`configure_astrolabe_for_mcp_server` test fixture.

Also bump `third_party/astrolabe` 0.13.12 → 0.14.0 to pull in the
chunk-context indexed-lookup fix (#75) and the PDF bbox highlight
overlay (#76) that match the master-side changes already merged on
this branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -293,7 +293,7 @@ services:
       # the same configure_astrolabe_for_mcp_server fixture (which creates the
       # static `nextcloudMcpServerUIPublicClient` OIDC client) works for tests
       # against this profile too.
-      - ALLOWED_MGMT_CLIENT=nextcloudMcpServerUIPublicClient
+      - ALLOWED_MGMT_CLIENT=astrolabeMcpClientOAuth00000000000
     volumes:
       - login-flow-data:/app/data
       - login-flow-oauth-storage:/app/.oauth