The login handler was re-reading the config on each attempt, which returned empty when no key was set, causing all logins to fail. Now uses the key resolved at startup (from config or generated). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>