Council portal sign-in

External-org realm. In production this is AWS Cognito council SSO + MFA (D31). On a dev box the in-api dev issuer mints the session — pick the synthetic principal, then enter the one-time code the api logged (or your DEV_ISSUER_FIXED_OTP). Your org + contract scope comes from the verified session, never from this page.