To get the UI working "out of the box", the following works - after moving the alias from _web to _app.

cp .env.example .env
APP_HOST=app docker-compose up

docker exec -ti treenga_open-node_1 npm install
docker exec -ti treenga_open-node_1 npm run dev
docker exec -ti treenga_open-app_1 composer update
docker exec -ti treenga_open-app_1 php artisan key:generate
 docker exec -ti treenga_open-app_1 php artisan passport:keys
docker exec -ti treenga_open-app_1 php artisan migrate:install
docker exec -ti treenga_open-app_1 php artisan migrate:fresh
mkdir storage/framework/logs
sudo chown www-data:www-data storage -R

This doesn't create an admin user though. I'm not well versed enough in Laravel to figure out how to create one.

docker exec -ti treenga_open-app_1 php artisan tinker
DB::table('users')->insert([
              'name' => 'admin',
              'email' => '[email protected]',
              'password' => bcrypt('admin'),
              'created_at' => date_create()->format('Y-m-d H:i:s'),
              'updated_at' => date_create()->format('Y-m-d H:i:s'), 'status' => 1, 'role' => 1
]);    

This gets rid of the failure to login message, not sure what the status and role should be, but then this happens:

[previous exception] [object] (League\OAuth2\Server\Exception\OAuthServerException(code: 3): The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed. at /var/www/vendor/league/oauth2-server/src/Exception/OAuthServerException.php:142)
[stacktrace]
#0 /var/www/vendor/league/oauth2-server/src/Grant/AbstractGrant.php(261): League\OAuth2\Server\Exception\OAuthServerException::invalidRequest('client_id')
#1 /var/www/vendor/league/oauth2-server/src/Grant/AbstractGrant.php(195): League\OAuth2\Server\Grant\AbstractGrant->getClientCredentials(Object(Nyholm\Psr7\ServerRequest))
#2 /var/www/vendor/league/oauth2-server/src/Grant/PasswordGrant.php(54): League\OAuth2\Server\Grant\AbstractGrant->validateClient(Object(Nyholm\Psr7\ServerRequest))
#3 /var/www/vendor/league/oauth2-server/src/AuthorizationServer.php(204): League\OAuth2\Server\Grant\PasswordGrant->respondToAccessTokenRequest(Object(Nyholm\Psr7\ServerRequest), Object(League\OAuth2\Server\ResponseTypes\BearerTokenResponse), Object(DateInterval))
#4 /var/www/vendor/laravel/passport/src/Http/Controllers/AccessTokenController.php(63): League\OAuth2\Server\AuthorizationServer->respondToAccessTokenRequest(Object(Nyholm\Psr7\ServerRequest), Object(Laminas\Diactoros\Response))
#5 /var/www/vendor/laravel/passport/src/Http/Controllers/HandlesOAuthErrors.php(24): Laravel\Passport\Http\Controllers\AccessTokenController->Laravel\Passport\Http\Controllers\{closure}()
#6 /var/www/vendor/laravel/passport/src/Http/Controllers/AccessTokenController.php(65): Laravel\Passport\Http\Controllers\AccessTokenController->withErrorHandling(Object(Closure))
#7 /var/www/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(48): Laravel\Passport\Http\Controllers\AccessTokenController->issueToken(Object(Nyholm\Psr7\ServerRequest))
#8 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Route.php(219): Illuminate\Routing\ControllerDispatcher->dispatch(Object(Illuminate\Routing\Route), Object(Laravel\Passport\Http\Controllers\AccessTokenController), 'issueToken')
#9 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Route.php(176): Illuminate\Routing\Route->runController()
#10 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(681): Illuminate\Routing\Route->run()
#11 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\Routing\Router->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request))
#12 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php(59): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#13 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Routing\Middleware\ThrottleRequests->handle(Object(Illuminate\Http\Request), Object(Closure))
#14 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#15 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(683): Illuminate\Pipeline\Pipeline->then(Object(Closure))
#16 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\Routing\Router->runRouteWithinStack(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request))
#17 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(624): Illuminate\Routing\Router->runRoute(Object(Illuminate\Http\Request), Object(Illuminate\Routing\Route))
#18 /var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php(613): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request))
#19 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(170): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request))
#20 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request))
#21 /var/www/vendor/barryvdh/laravel-cors/src/HandleCors.php(36): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#22 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Barryvdh\Cors\HandleCors->handle(Object(Illuminate\Http\Request), Object(Closure))
#23 /var/www/vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#24 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fideloper\Proxy\TrustProxies->handle(Object(Illuminate\Http\Request), Object(Closure))
#25 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#26 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure))
#27 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#28 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure))
#29 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#30 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle(Object(Illuminate\Http\Request), Object(Closure))
#31 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(63): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#32 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure))
#33 /var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request))
#34 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\Pipeline\Pipeline->then(Object(Closure))
#35 /var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(110): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request))
#36 /var/www/public/index.php(55): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request))
#37 {main}
"}

It seems clear that I need to link the user to an OAuth access token, but so far I haven't figured out how.