diff --git a/package.json b/package.json
index 293c74a1..835e821e 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "packageManager": "pnpm@10.33.2",
   "scripts": {
-    "dev": "next dev --turbopack",
+    "dev": "next dev --turbopack -H 0.0.0.0",
     "build": "next build && pnpm build:server",
     "build:server": "esbuild src/server.ts --bundle --platform=node --target=node20 --format=cjs --outdir=dist --packages=external --tsconfig=tsconfig.server.json",
     "build:worker": "esbuild src/worker.ts --bundle --platform=node --target=node20 --format=cjs --outdir=dist --packages=external --tsconfig=tsconfig.server.json",
diff --git a/src/app/api/v1/website-analytics/route.ts b/src/app/api/v1/website-analytics/route.ts
index cdef0afe..1ee28b60 100644
--- a/src/app/api/v1/website-analytics/route.ts
+++ b/src/app/api/v1/website-analytics/route.ts
@@ -104,9 +104,14 @@ export const GET = withAuth(
       }
 
       // `data === null` from the service means Umami isn't configured for
-      // this port - surface that explicitly so the UI can render a
-      // "configure your credentials" empty state instead of a chart.
-      if (data === null) throw new CodedError('UMAMI_NOT_CONFIGURED');
+      // this port. Return 200 with `data: null` + the explicit
+      // `notConfigured: true` flag so the UI renders a "configure your
+      // credentials" empty state. **Do not throw** — a 409 here would
+      // trigger React Query's default retry loop, and every retry fires
+      // a system_settings lookup → pool saturation → server hang.
+      if (data === null) {
+        return NextResponse.json({ metric, range, data: null, notConfigured: true });
+      }
 
       return NextResponse.json({ metric, range, data });
     } catch (err) {
diff --git a/src/components/dashboard/website-glance-tile.tsx b/src/components/dashboard/website-glance-tile.tsx
index 8326b130..893a9115 100644
--- a/src/components/dashboard/website-glance-tile.tsx
+++ b/src/components/dashboard/website-glance-tile.tsx
@@ -27,10 +27,9 @@ export function WebsiteGlanceTile() {
 
   // Hide the tile entirely if Umami isn't configured - this dashboard is
   // for sales, not for prompting the operator into integration setup.
-  if (
-    stats.data?.error === 'umami_not_configured' ||
-    active.data?.error === 'umami_not_configured'
-  ) {
+  // The API surfaces `notConfigured: true` on a 200 response so React
+  // Query doesn't retry-loop (a prior 409-throw caused server hangs).
+  if (stats.data?.notConfigured || active.data?.notConfigured) {
     return null;
   }
 
diff --git a/src/components/shared/branded-auth-shell.tsx b/src/components/shared/branded-auth-shell.tsx
index 83177efc..fc26e3c2 100644
--- a/src/components/shared/branded-auth-shell.tsx
+++ b/src/components/shared/branded-auth-shell.tsx
@@ -30,11 +30,17 @@ interface BrandedAuthShellProps {
 export function BrandedAuthShell({ children, branding }: BrandedAuthShellProps) {
   const logoUrl = branding?.logoUrl || DEFAULT_LOGO_URL;
   const altText = branding?.appName || 'Port Nimara';
+  // fixed inset-0 anchors the auth surface to the viewport directly —
+  // iOS Safari ignores overflow-hidden on inner divs for body-level
+  // scrolling, so a regular `h-[100dvh] overflow-hidden` wrapper doesn't
+  // stop the rubber-band bounce. Pinning to the viewport via position
+  // fixed does. The fixed-position shell then uses flex to center the
+  // card within the visible area.
   return (
-    <div className="relative min-h-screen min-h-[100dvh] flex items-center justify-center px-4 py-8">
+    <div className="fixed inset-0 flex items-center justify-center px-4 py-8 overscroll-none">
       <div
         aria-hidden
-        className="fixed inset-0 -z-10"
+        className="absolute inset-0 -z-10"
         style={{
           backgroundImage: `url('${DEFAULT_BG_URL}')`,
           backgroundSize: 'cover',
diff --git a/src/components/website-analytics/use-website-analytics.ts b/src/components/website-analytics/use-website-analytics.ts
index fbe013a4..d72f0d31 100644
--- a/src/components/website-analytics/use-website-analytics.ts
+++ b/src/components/website-analytics/use-website-analytics.ts
@@ -25,10 +25,13 @@ import type {
 interface MetricResponse<T> {
   metric: string;
   range: DateRange;
-  data: T;
-  /** Surfaced when Umami isn't configured for the port - UI can render a
-   *  "set up Umami" empty state instead of a generic loading spinner. */
-  error?: string;
+  data: T | null;
+  /** True when Umami isn't configured for the port. Surfaced as a 200
+   *  response (not 4xx) so React Query doesn't infinitely retry — that
+   *  retry loop previously saturated the postgres pool and hung the dev
+   *  server. UI consumers should check this flag and render the
+   *  "set up Umami" empty state. */
+  notConfigured?: boolean;
 }
 
 function rangeToQuery(range: DateRange): string {
diff --git a/src/components/website-analytics/website-analytics-shell.tsx b/src/components/website-analytics/website-analytics-shell.tsx
index 68c8a20d..26388e0b 100644
--- a/src/components/website-analytics/website-analytics-shell.tsx
+++ b/src/components/website-analytics/website-analytics-shell.tsx
@@ -45,11 +45,11 @@ export function WebsiteAnalyticsShell() {
   const topReferrers = useUmamiTopReferrers(range);
   const topCountries = useUmamiTopCountries(range);
 
-  // Any of the queries returning `error: 'umami_not_configured'` means we
-  // need to prompt the operator to set credentials. Single empty state
-  // covers all widgets so the page doesn't show six loading spinners that
-  // never resolve.
-  const notConfigured = stats.data?.error === 'umami_not_configured';
+  // API surfaces `notConfigured: true` on a 200 response (not 4xx) so
+  // React Query doesn't infinite-retry — that retry loop saturated the
+  // postgres pool and stalled the dev server. Single empty state covers
+  // all widgets so the page doesn't show six loading spinners forever.
+  const notConfigured = stats.data?.notConfigured === true;
 
   return (
     <div className="space-y-6">