- Add oauth2_provider.url pointing to hydra-admin so login_challenge params are accepted (fixes People OIDC login flow) - Scope session cookie to parent DOMAIN_SUFFIX so admin.* subdomains share the session (fixes redirect loop on kratos-admin-ui) - Add allowed_return_urls for admin.*, enable recovery flow, add error and recovery ui_url entries - Fix KRATOS_PUBLIC_URL port in login-ui deployment (4433 → 80)