Demo sign-in — this form only appears under AUTH_MODE=demo, which the offline demo and the pi5 appliance run because neither can reach an identity provider. Accounts: demo1, demo2, kenneth, password demo. Each maps to its own ext_ref_id, so each sees only its own servers.