AZURE_CLIENT_ID=<app-registration-client-id>
AZURE_TENANT_ID=<azure-ad-tenant-id>

# Set to true for local dev to skip JWT verification (never use in production)
# DEV_AUTH_BYPASS=true

# Client needs VITE_ prefix — create client/.env with:
# VITE_AZURE_CLIENT_ID=<same as above>
# VITE_AZURE_TENANT_ID=<same as above>