AZURE_CLIENT_ID=<app-registration-client-id>
AZURE_TENANT_ID=<azure-ad-tenant-id>

# Set to true for local dev to skip JWT verification (never use in production)
# DEV_AUTH_BYPASS=true

# AI lock duration in hours (default: 24, use 168 for 7 days)
# AI_LOCK_EXPIRY_HOURS=168

# Client needs VITE_ prefix — create client/.env with:
# VITE_AZURE_CLIENT_ID=<same as above>
# VITE_AZURE_TENANT_ID=<same as above>
# VITE_DEV_AUTH_BYPASS=true   ← DEV ONLY: skips MS login in browser (never set in production)