Demo SSO

Two sign-in paths, one user pool. Whichever you use, the pages behind this form read the same cognito:groups claim.

No user pool is configured yet. Set USER_POOL_ID and USER_POOL_CLIENT_ID for this deployment and redeploy — no image rebuild is needed, they are read at runtime.