[Tech Debt] Implement periodic cleanup for token refresh locks

[cbcoutinho]

Context

From PR #401 code review - Medium priority follow-up item.

Problem

Token broker's _user_refresh_locks dictionary (line 132) accumulates locks but never cleans up unused ones, leading to potential memory leak over time.

Proposed Solution

Implement periodic cleanup of locks that haven't been used recently. Consider:

• Track last access time per lock
• Background task to clean locks older than threshold (e.g., 1 hour)
• Configurable cleanup interval

References

• File: nextcloud_mcp_server/auth/token_broker.py:132
• Related to PR feat(astrolabe): Nextcloud app UI with PDF viewer, webhooks, and OAuth refresh #401 security fixes

Priority

Medium - Does not affect correctness, but impacts long-running deployments