Each script: full OIDC webflow per app (gitea /user/oauth2/cloudron,
redmine /oauth?oauth_provider=1 GET-form, discourse /auth/oidc with
CSRF + confirm-page token), TOTP from vault seed, session verify.
Ran fleet-wide 2026-09-09: accounts created for all 32 org identities;
gitea tokens + redmine/discourse api keys minted via admin levers and
stored per identity in the vault.
https://projects.knownelement.com/issues/942
