Production setup: Set
AWS_OAUTH_CLIENT_ID, AZURE_OAUTH_CLIENT_ID, and/or GCP_OAUTH_CLIENT_ID (plus the matching _SECRET vars) on the backend Railway service to exit mock mode and use real OAuth flows. Topology discovery currently returns a stub layout per provider; live EC2/AKS/GKE adapters are a follow-up PR.