Migrate each spoke to federate via a Custom OIDC Provider (confidential client + JWKS, branded /auth/v1/callback). CargoWorks AI leads as the first cutover.