- Change login_attribute_path from preferred_username to email for stable user matching - Enable allow_sign_up to permit OAuth user sync with existing local users - Root cause: Authentik's 'rock' user matches existing Grafana 'rock' by email, not by preferred_username claim