SecChat

Dev sign-in. This mints a client-side token (dev.<username>.<groups>) — there is no password, and nothing but the username shape is checked. Real sign-in will go through SecSSO (Authentik) once wired.