Parallel public host while apex stays Bubble; keep apex redirect for later.
Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration.
Idempotent patch of sso/keycape-config with public PKCE client and redirect URIs for local :8008 and production coulomb.social callbacks.
