Local sign-in (tailnet only recommended).
Users are created via ops script (argon2id password hashes). No public signup.