@@ -16,3 +16,12 @@ RUST_LOG=meguri=info,cot=warn
 # Tenant-specific JSM deployment secrets. Replace UUID_WITHOUT_DASHES with uppercase tenant ID.
 # MEGURI_JSM_UUID_WITHOUT_DASHES_EMAIL=integration@example.com
 # MEGURI_JSM_UUID_WITHOUT_DASHES_TOKEN=from-your-secret-manager
+
+# Explicit one-time site administrator grant to an existing local username.
+# MEGURI_BOOTSTRAP_ADMIN=admin
+# OIDC settings UI is draft-only; the authentication adapter is not active yet.
+# MEGURI_OIDC_CLIENT_SECRET=provided-by-deployment-secret-store
+
+# One-time migration of existing login accounts: required only for missing or
+# ambiguous emails. Existing unambiguous linked Person emails are recovered.
+# MEGURI_ACCOUNT_EMAILS='{"admin":"admin@example.com"}'