When enable_login_flow is true, also check the app_passwords table for provisioned users. Previously, OAuth mode only queried the refresh_tokens table, missing users who were provisioned via Login Flow v2 (which stores app passwords, not refresh tokens). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>