Parse object-shaped mfc v2 dumps (the format Proxmark writes today) and
let the new-tag form upload dump.json/dump.bin plus an optional binary
hf-mf-*-key.bin instead of only pasting text.
Auth.js OIDC only reads ID-token claims by default; Authelia puts
email on UserInfo. Set idToken:false, harden claim extraction, and
document an optional Authelia claims_policy.
/login was prerendered at Docker build time when AUTH_OIDC_* were
unset, baking oidcEnabled=false into the page. Force dynamic render
and also read /api/v1/auth/config on the client as a fallback.
Cursor Agent