To get the UI working "out of the box", the following works - after moving the alias from _web to _app.

cp .env.example .env
APP_HOST=app docker-compose up

docker exec -ti treenga_open-node_1 npm install
docker exec -ti treenga_open-node_1 npm run dev
docker exec -ti treenga_open-app_1 composer update
docker exec -ti treenga_open-app_1 php artisan key:generate
 docker exec -ti treenga_open-app_1 php artisan passport:keys
docker exec -ti treenga_open-app_1 php artisan migrate:install
docker exec -ti treenga_open-app_1 php artisan migrate:fresh
mkdir storage/framework/logs
sudo chown www-data:www-data storage -R

This doesn't create an admin user though. I'm not well versed enough in Laravel to figure out how to create one.

docker exec -ti treenga_open-app_1 php artisan tinker
DB::table('users')->insert([
              'name' => 'admin',
              'email' => '[email protected]',
              'password' => bcrypt('admin'),
              'created_at' => date_create()->format('Y-m-d H:i:s'),
              'updated_at' => date_create()->format('Y-m-d H:i:s'), 'status' => 1, 'role' => 1
]);    

This gets rid of the failure to login message, not sure what the status and role should be, but then this happens:

[previous exception] [object] (League\OAuth2\Server\Exception\OAuthServerException(code: 3): The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. at /var/www/vendor/league/oauth2-server/src/Exception/OAuthServerException.php:142) [stacktrace] #0 /var/www/vendor/league/oauth2-server/src/Grant/AbstractGrant.php(261): League\OAuth2\Server\Exception\OAuthServerException::invalidRequest('client_id') #1 /var/www/vendor/league/oauth2-server/src/Grant/AbstractGrant.php(195): League\OAuth2\Server\Grant\AbstractGrant->getClientCredentials(Object(Nyholm\Psr7\ServerRequest)) #2 /var/www/vendor/league/oauth2-server/src/Grant/PasswordGrant.php(54): League\OAuth2\Server\Grant\AbstractGrant->validateClient(Object(Nyholm\Psr7\ServerRequest)) #3 /var/www/vendor/league/oauth2-server/src/AuthorizationServer.php(204): League\OAuth2\Server\Grant\PasswordGrant->respondToAccessTokenRequest(Object(Nyholm\Psr7\ServerRequest), Object(League\OAuth2\Server\ResponseTypes\BearerTokenResponse), Object(DateInterval)) #4 /var/www/vendor/laravel/passport/src/Http/Controllers/AccessTokenController.php(63): League\OAuth2\Server\AuthorizationServer->respondToAccessTokenRequest(Object(Nyholm\Psr7\ServerRequest), Object(Laminas\Diactoros\Response)) #5 /var/www/vendor/laravel/passport/src/Http/Controllers/HandlesOAuthErrors.php(24): Laravel\Passport\Http\Controllers\AccessTokenController->Laravel\Passport\Http\Controllers\{closure}() #6 /var/www/vendor/laravel/passport/src/Http/Controllers/AccessTokenController.php(65): Laravel\Passport\Http\Controllers\AccessTokenController->withErrorHandling(Object(Closure)) #7 /var/www/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(48): Laravel\Passport\Http\Controllers\AccessTokenController->issueToken(Object(Nyholm\Psr7\ServerRequest)) #8 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Route.php(219): Illuminate\Routing\ControllerDispatcher->dispatch(Object(Illuminate\Routing\Route), Object(Laravel\Passport\Http\Controllers\AccessTokenController), 'issueToken') #9 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Route.php(176): Illuminate\Routing\Route->runController() #10 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(681): Illuminate\Routing\Route->run() #11 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\Routing\Router->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) #12 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php(59): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #13 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Routing\Middleware\ThrottleRequests->handle(Object(Illuminate\Http\Request), Object(Closure)) #14 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #15 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(683): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #16 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\Routing\Router->runRouteWithinStack(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request)) #17 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(624): Illuminate\Routing\Router->runRoute(Object(Illuminate\Http\Request), Object(Illuminate\Routing\Route)) #18 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(613): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request)) #19 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(170): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request)) #20 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request)) #21 /var/www/vendor/barryvdh/laravel-cors/src/HandleCors.php(36): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #22 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Barryvdh\Cors\HandleCors->handle(Object(Illuminate\Http\Request), Object(Closure)) #23 /var/www/vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #24 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fideloper\Proxy\TrustProxies->handle(Object(Illuminate\Http\Request), Object(Closure)) #25 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #26 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure)) #27 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #28 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure)) #29 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #30 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle(Object(Illuminate\Http\Request), Object(Closure)) #31 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(63): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #32 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure)) #33 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) #34 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\Pipeline\Pipeline->then(Object(Closure)) #35 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(110): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request)) #36 /var/www/public/index.php(55): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request)) #37 {main} "}

It seems clear that I need to link the user to an OAuth access token, but so far I haven't figured out how.