- compose: SSO_ENABLED, SSO_AUTHORITY and the two client credentials, with the
undocumented redirect path written down where people will look for it
- .env.example: was referenced by the README since episode 1 but never actually
committed, so a fresh clone could not follow the quickstart
- README: the four steps, plus the debugging notes that cost the most time
(no SSO line at startup, 404 on routes without query parameters, HEAD on the
discovery endpoint, and the three-step member join)
- HARDENING: never copy db.sqlite3 alone while the container runs. WAL mode
keeps recent writes in a side file, so that backup silently misses data
