Break-glass sign-in

This deployment has an interactive sign-in. Use that unless the identity provider is unreachable — break-glass is the outage path, not the everyday one.

Mint one on the host:

docker compose --env-file .env -f docker-compose.prod.yml exec api \
    dotnet Vahary.Respond.Api.dll mint-operator-token \
    --email you@example.com --role respond.admin --customer <guid>

The session this creates expires when the token does — nothing is stored, and a short-lived token stays short-lived.