Google OAuth
Sign-in requires a dedicated Google OAuth client with http://localhost:3027/api/auth/callback/google registered as an authorized redirect URI, and the backend started with the same client ID so it validates ID tokens against the right audience. run.sh wires this automatically from jaas-ui’s own .env.local.
Dev login (no Google client needed)
Set JAAS_DEV_LOGIN_PASSWORD in .env.local, then use “Sign in with email” at /login with the local-only accounts documented in .env.local.example (owner@jaas.local / admin@jaas.local).
The backend refuses this path entirely unless configured. Without JAAS_DEV_LOGIN_PASSWORD set, dev login is not merely hidden — the API rejects the request outright, so it can’t be left accidentally reachable in an environment where the variable is unset.
