NO AUTHENTICATION — anyone with this link can read and write everything. This deployment is running with NPA_ALLOW_NO_AUTH=1. Unset it and configure AUTH_MICROSOFT_ENTRA_ID_ID + AUTH_MICROSOFT_ENTRA_ID_SECRET to require Microsoft sign-in.