residentKey: 'preferred' → 'required' so Firefox stores passkeys as discoverable credentials. The OIDC login page authenticates without allowCredentials (user not identified yet), which requires discoverable credentials to work.