Dual OIDC (Entra & Azure AD B2C), SQL Server Express DB, role/org-gated content, and full IdP logout.