A public custom script submits the OIDC form on /admin/login and CSS
hides the password form. /admin/login?local=1 (or a failed password
attempt) shows it for break-glass use; a 15s guard prevents loops.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
