Minimal env vars (DATABASE_URL + MOSAIC_SECRET_KEY), all config in Postgres, onboarding wizard, breakglass auth, OIDC via settings UI.