Add backend.oidc.iosRedirectUri (default: timetracker://oauth/callback) and backend.jwt.secret to values.yaml and wire them into the backend deployment as OIDC_IOS_REDIRECT_URI and JWT_SECRET env vars. Update NOTES.txt to surface both values post-install.