- oidc-clients.yaml: change people redirect URI from /oidc/callback/ to /api/v1.0/callback/ (the actual path the Django app registers) - people-values.yaml: set DJANGO_CONFIGURATION=Production so Django trusts X-Forwarded-Proto from Pingora and generates https:// URLs; add ALLOWED_HOSTS and DJANGO_CSRF_TRUSTED_ORIGINS for the people subdomain