The authentik OIDC round-trip is verified, so retire the local username/password path. ENABLE_LOGIN_FORM hides the form and ENABLE_PASSWORD_AUTH refuses password logins; the only way in is now the OIDC flow, which folds into the local account by email. The ui.enable_login_form config-DB override is flipped to false in the same change (the DB wins over env, so both must agree).