A stale env value that guaranteed a login failure
Google OAuth rejects LAN-IP redirect URIs outright, so a stale LAN address left in the redirect URI guaranteed login failure regardless of the IP being correct.
Two copies drifted
One idea kept by hand in two places — schema and migration, dev and prod, app and app.
.env had five references to a LAN IP that had stopped matching this machine's address at some point. Most of the app uses localhost and works either way, so the wrong value sat there doing nothing. One of the five was the Google OAuth redirect URI, and Google rejects LAN-IP redirect URIs outright regardless of whether the IP is even correct — so Google login was guaranteed to fail the moment I tried it, for reasons having nothing to do with the OAuth integration.
Caught before wasting a session on it because the mobile API base URL shared the same stale IP and was obviously unreachable, which made me check the other four. An env var that usually doesn't matter because most consumers default to localhost is exactly the kind that rots silently, and when it finally breaks something it looks like a bug in that feature rather than a stale config line five features away.