Private setup

Set up owner access.

This one-time enrollment is available only while the deployment owner has configured the setup secret. The secret is checked server-side and is never displayed or stored.