Sign-in is currently disabled
Password login (POST /api/auth/login) and OAuth start/callback refuse when isLoginOpen() is false. Product: Sign-in is currently disabled.
Why this happens
Login enabled (or equivalent site setting) is off — maintenance or intentional lockout. Distinct from Registration is currently disabled (signup only).
Diagnose and fix
1. Admin: turn on Login enabled; save.
2. Confirm the login page is open (not a closed banner).
3. Members: wait until staff re-opens sign-in; registration may still be separate.
4. OAuth buttons also fail with the same message while login is closed.