- Switch all user-facing app OAuth2 clients to client_secret_post (mozilla-django-oidc sends credentials in POST body by default) - Set LOGIN_REDIRECT_URL=/ so Django redirects to frontend after login - Add local overlay patch to disable OIDC SSL verification (mkcert CA not trusted inside pods; production uses real certs)