fix(coulomb): use canonical user service during personal login

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

workplans/RAPPS-WP-0015-coulomb-personal-content-release.md

@@ -128,3 +128,20 @@ another service. No password was requested/read/exported or reset. Authelia's
 current notifier is filesystem rather than SMTP: do not promise emailed recovery
 or expose reset tokens from notification files. Any credential reset must use
 the owning attended recovery/setup lane under a separate exact approved change.
+
+## Personal login 500 correction — 2026-10-06
+
+User confirmed fresh password-reset email receipt, then reported HTTP500 after
+authentication. In-pod credential-safe read-only probes with empty claims show
+old USER_ENGINE_BASE_URL redirects302 to users.coulomb.social/api/v1/me; canonical
+endpoint responds400 to empty claims using the existing service credential. No
+identity was created. The application's httpx client does not follow redirects
+and raise_for_status rejects302 before establishing its local session.
+
+Correct USER_ENGINE_BASE_URL in chart defaults and production overrides to
+https://users.coulomb.social. Preserve immutable image, Secret references,
+identity issuer/subject/tenant, PVC and access rules. This completes the already
+approved personal app deployment; founder go/interruption approval is recorded
+in decision8bbce691-a787-4140-9cd4-df06e8635a27. Use node-side Helm atomic upgrade,
+server dry-run and exact manifest diff; rollback revision10 if necessary. T04
+remains waiting for successful interactive personal workspace acceptance.