The paperless-oidc Secret carries the OIDC client secret twice: once as
`client-secret` and once inside SOCIALACCOUNT_PROVIDERS_JSON, which is what
allauth actually reads. Only the JSON copy was updated during the ZITADEL
migration, so `client-secret` held a superseded rotation.
That is invisible in normal use but makes the Secret misleading to verify:
a token-endpoint probe using `client-secret` answers "invalid secret" while
Paperless itself logs in fine. Both keys now carry the same live value.
rock