svc-sigrun
FastAPI backend — app layout, async pool, lifespan.
Authentik OIDC
Token shape Sigrun validates; required claims.