Use real Allow clicks (JS click breaks React action), then browser-side Next.js Server Action POST as fallback; harden SSO cookie injection.
Use real Allow clicks (JS click breaks React action), then browser-side Next.js Server Action POST as fallback; harden SSO cookie injection.