Google sign-in is not configuredThis deployment has no OAuth client. A Google web client with redirect URI https://portal.opswrx.com/api/auth/callback is needed.

Staging sign-in is enabledThis rig lets a seeded test account sign in without Google, so the permission model can be exercised without 43 real accounts. It is refused outright on any production hostname or parent-domain cookie.