APP_URL=
OIDC_ISSUER_URL=
OIDC_CLIENT_ID=
OIDC_REDIRECT_URI=
OIDC_IOS_REDIRECT_URI=timetracker://oauth/callback
SESSION_SECRET=
# Optional: dedicated signing secret for backend-issued JWTs (iOS auth).
# Falls back to SESSION_SECRET if not set.
JWT_SECRET=
API_URL=