Instance settings. Separate from the user login, because whoever runs this deployment is not necessarily someone who stores memories in it.
ENGRAM_ENCRYPTION_KEY is not set.
Settings are encrypted at rest, so the operator surface stays off until there is a key. Generate one with:
node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
Change the seeded password before anything else.
Sign in with this device instead of the password.
None yet.
Stored encrypted. A stored value overrides the environment; clearing one falls back to it. Secrets are never shown again after saving.