Private alpha setup

Enroll this browser

This is not a login screen. Paste the short-lived parent session issued by the CLI. It stays in this tab's session storage and is sent only as a Bearer header to setup endpoints.

Family UUIDCLI-issued parent session

Parent sessions expire within 24 hours. Issue one with make parent-session-issue (DATABASE_URL in the environment). Device list, retention, export, and deletion live on /privacy. OAuth/password login and QR handoff remain out of private-alpha scope.