Authentication
Hot-swappable strategies. Changes apply immediately and are
persisted to gigot.json. Rebuilds
run under a lock. If a new secret_ref or
discovery URL fails, the old state stays live.
Local password path
Allow local login
Turn off once OAuth or gateway is wired (Phase 5). Keep on
during the bootstrap of a fresh deploy so the primary admin
can reach the UI.
OAuth providers
client_secret_ref names a credential in the
vault. Edit the secret value in
Credentials.
Gateway (signed-header strategy)
Enabled
Auto-register unknown users as regular