A public custom script submits the OIDC form on /admin/login and CSS hides the password form. /admin/login?local=1 (or a failed password attempt) shows it for break-glass use; a 15s guard prevents loops. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>