SKILL: fleet-proven procedure — per-app SSO scripts, admin key minting, access restrictions, vault fallbacks
Absorbs the 2026-09-09 fleet-wide rollout learnings: per-app SSO entry
points and quirks (discourse /auth/oidc + CSRF + confirm, redmine
oauth_provider=1, gitea username normalization), Cloudron app
accessRestriction management, central admin-lever key minting for
gitea/redmine/discourse (GLPI deferred on #947), and the
setfield-verify-recreate seed-storage pattern.
https://projects.knownelement.com/issues/942
mrcharles
5b6baa7ff7