• Accounts a person can sign in to: Argon2id, TOTP, and no account enumeration.
• The web interface begins, under /app and nowhere else, built in the image and checked in CI.
• Cookie authentication with its own read endpoints, kept off the v3 API.
• Mail, settings, notifications and invitations; a Zotero client approved from the browser.
• People managing their own API keys, with when and where each was last used.