fix: address remaining PR #589 review findings

- Consolidate MCP session + login flow cleanup into _mcp_session_with_login_flow() helper,
  replacing 4 duplicated AsyncExitStack sites in app.py
- Fix get_shared_storage() race condition by using module-level anyio.Lock() init
  (reverts regression from ba59763)
- Collapse cosmetic if/else branching in scope_authorization.py
- Consolidate dual password storage paths into single store_app_password_with_scopes() call
- Mark unused request param as _ in list_supported_scopes
- Make ALL_SUPPORTED_SCOPES an immutable tuple; use list() instead of .copy()
- Add hasattr(ctx, "elicit") guard in elicitation.py, narrow except to NotImplementedError
- Add YAML comment explaining --oauth flag for mcp-login-flow service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

nextcloud_mcp_server/auth/scope_authorization.py

@@ -128,17 +128,10 @@ def require_scopes(*required_scopes: str):
             )
 
             if access_token is None:
-                # No OAuth token — either BasicAuth with env var credentials
-                # or BasicAuth without explicit credentials. Both bypass scope checks.
-                settings = get_settings()
-                if settings.nextcloud_app_password or settings.nextcloud_password:
-                    logger.debug(
-                        f"No access token for {func_name} - allowing (env var app password)"
-                    )
-                else:
-                    logger.debug(
-                        f"No access token present for {func_name} - allowing (BasicAuth mode)"
-                    )
+                # No OAuth token — BasicAuth mode bypasses scope checks
+                logger.debug(
+                    f"No access token for {func_name} - allowing (BasicAuth mode)"
+                )
                 return await func(*args, **kwargs)
 
             # ── Login Flow v2: Check stored app password scopes ──