fix: address PR #589 review findings

- Fix anyio.Lock() created at module import time; use lazy init in
  get_shared_storage() to avoid instantiation before event loop exists
- Stop get_login_flow_session from silently swallowing DB exceptions;
  re-raise and handle in caller with proper error response
- Update ProvisionAccessResponse and UpdateScopesResponse status field
  docs to include all actual values (declined, cancelled, unchanged)
- Narrow except clause in present_login_url to (AttributeError,
  NotImplementedError) instead of bare Exception
- Add KeyError handling in LoginFlowV2Client.initiate() and poll() for
  clear errors on malformed Nextcloud responses
- Simplify redundant env-var bypass branches in scope_authorization.py
- Extract _maybe_login_flow_cleanup() context manager to replace 4
  inline cleanup loop registrations in app.py; move sleep to end of
  loop body so cleanup runs once at startup
- Replace fragile string replacement in _rewrite_login_flow_url with
  proper urllib.parse URL handling

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/server/login_flow/conftest.py

@@ -14,7 +14,7 @@ import os
 import secrets
 import time
 from typing import Any, AsyncGenerator
-from urllib.parse import quote
+from urllib.parse import quote, urlparse, urlunparse
 
 import anyio
 import httpx
@@ -214,10 +214,11 @@ def _rewrite_login_flow_url(login_url: str) -> str:
     the host and needs localhost:8080 instead.
     """
     nextcloud_host = os.getenv("NEXTCLOUD_HOST", "http://localhost:8080")
-    # Replace common internal Docker hostnames
-    url = login_url.replace("http://app:80", nextcloud_host)
-    url = url.replace("http://app", nextcloud_host)
-    return url
+    target = urlparse(nextcloud_host)
+    parsed = urlparse(login_url)
+    if parsed.hostname == "app":
+        parsed = parsed._replace(scheme=target.scheme, netloc=target.netloc)
+    return urlunparse(parsed)
 
 
 async def _complete_login_flow_v2(browser, login_url: str) -> None: