Oops. Hydra, the OAuth2 backend I'm using, quietly upgraded itself at some point, and that broke login. Fixed now (clearly, or I couldn't post).
Lesson learned: Use a specific version tag on containers (not :latest, or no tag).
Not that expensive a lesson this time at least.