The SSO button required NEXT_PUBLIC_AUTH_OIDC_ENABLED, which is baked at build time and silently fails under Docker runtime env. Drive the login button from server-side AUTH_OIDC_* instead, and document IdP redirect URI + AUTH_URL setup.
