feat(DPoP): check requests and 401 on failure

src/interfaces/nextcloud/basic_auth_middleware.rs

@@ -203,11 +203,15 @@ pub async fn basic_auth_middleware(
             // `Arc<CurrentUser>` extension AND `NcSession.user` (the old
             // code built the struct, cloned it for the extension, then
             // moved the original — 2-3 String allocs per request).
+            // Nextcloud clients are always unbound — they authenticate
+            // with app passwords via Basic Auth, no WebCrypto, no DPoP.
+            // Middleware exempts unbound sessions per Gate 9 design.
             let current_user = Arc::new(CurrentUser {
                 id: user_id,
                 username: uname,
                 email,
                 role,
+                dpop_jkt: None,
             });
 
             // ── Resolve chroot from the Basic Auth drive marker ─────

src/interfaces/nextcloud/login_v2_handler.rs

@@ -342,6 +342,9 @@ pub async fn handle_oidc_login_completion(
         username: std::sync::Arc::from(username),
         email: std::sync::Arc::from(user_dto.email.as_str()),
         role: smol_str::SmolStr::new(&user_dto.role),
+        // NC login-flow-v2 mints an app password — no browser, no
+        // WebCrypto, always unbound. DPoP middleware exempts.
+        dpop_jkt: None,
     };
 
     let drives = match state
@@ -553,6 +556,9 @@ pub async fn handle_drive_pick(
         username: std::sync::Arc::from(username.as_str()),
         email: std::sync::Arc::from(user_dto.email.as_str()),
         role: smol_str::SmolStr::new(&user_dto.role),
+        // NC login-flow-v2 mints an app password — no browser, no
+        // WebCrypto, always unbound. DPoP middleware exempts.
+        dpop_jkt: None,
     };
 
     let _folder = match state