The live Secret carried a hand-written entry for poimen-llm, which a reconcile would
have dropped: the config Secret is managed from this file.
Add poimen-llm and paperless-llm to zitadelClientIds, and switch on
allowListedMachineIdentities so an allow-listed caller is admitted without a roles
claim. ZITADEL does not put roles in a machine-user token on this instance, so the
allow-list entry is what authorises the caller; the caller still proves possession of a
registered private key.
Admin Bot