Session flow
Continue to secure sign in.
Continue starts a short secure sign-in checkpoint and returns to identitas for local session creation.
Environment required
Configure the identity env vars first.
`APP_URL`, `SESSION_SECRET`, `KEYCLOAK_ISSUER_URL`, `KEYCLOAK_CLIENT_ID`, `KEYCLOAK_CLIENT_SECRET`, and `DATABASE_URL` are required for the real identity sign-in flow.
Missing right now: DATABASE_URL
Until those are set, the page still builds cleanly, but the login route will reject at runtime instead of silently falling back to an insecure pattern.