ci: raise the coverage gate to 90 percent; docs: reconcile OAuth docs with the implementation

docs/troubleshooting.md

@@ -13,6 +13,8 @@ Gitea's sanitized message, and the audit log has one event per call (see
 | Exit code 2, "env file ... does not exist" | The file named by `--env-file` or `AEGIS_ENV_FILE` is missing or not a regular file. |
 | Exit code 2, refuses a non-loopback bind | `MCP_HOST` is not loopback and there is no `MCP_BEARER_TOKEN` or complete OAuth setup. Set one of them, or bind `127.0.0.1` behind a reverse proxy. |
 | Exit code 2, lists OAuth settings | `OAUTH_ENABLED=true` needs `GITEA_OAUTH_CLIENT_ID`, `GITEA_OAUTH_CLIENT_SECRET`, `TOKEN_ENCRYPTION_KEY` and `PUBLIC_BASE_URL`. |
+| Exit code 2, "cannot decrypt .../oauth-store.json" | `TOKEN_ENCRYPTION_KEY` differs from the key the store was written with (or the file is damaged). The server does not wipe it. Restore the original key, or move `DATA_DIR/oauth-store.json` away to start over (signs every OAuth user out). |
+| Exit code 2, "owned by another user" or "writable by group or others" (OAuth) | `DATA_DIR` must belong to the user the server runs as and not be group or world writable. Fix the owner or `chmod 700`. |
 | Validation error naming a setting | See the rules in [configuration.md](configuration.md): URLs must be http(s) without credentials, `PUBLIC_BASE_URL` must be https, secrets need 32 characters, `OAUTH_SCOPES` accepts only granular scopes. |
 | Startup error listing tool names | `DISABLED_TOOLS` contains names that are not registered. Check [tools.md](tools.md). |
 
@@ -69,8 +71,13 @@ A tool the client cannot see is probably filtered by `TOOLSETS`, `READ_ONLY` or
 - Gitea shows a redirect URI error: the OAuth application's redirect URI must be exactly
   `<PUBLIC_BASE_URL>/oauth/callback`. Re-run `setup --public-base-url ...` or fix it in Gitea.
 - Signed in, but admin tools return 403: the user is not a site administrator. That is intended.
-- Users are asked to sign in again after a restart: `TOKEN_ENCRYPTION_KEY` or the `DATA_DIR`
-  volume changed. The key must stay stable and the volume persistent.
+- Users are asked to sign in again after a restart: the `DATA_DIR` volume changed or was not
+  persistent (a changed `TOKEN_ENCRYPTION_KEY` stops startup instead, see above). Keep the key
+  stable and the volume persistent.
+- The sign-in page says the request is invalid or expired: the consent page lives 10 minutes
+  and a form is single use. Start the sign-in again from the client. Registration or sign-in
+  refused with "too many": one client address may hold 20 pending sign-ins and register 20
+  clients per hour.
 - After fixing OAuth settings the client still fails: some clients cache tokens. Disconnect the
   server in the client and connect again, which starts a fresh flow. Users can also revoke the
   application under Settings, Applications, Authorized OAuth2 Applications in Gitea.