Summary

• add operator-issued onboarding auth string evidence to signup requests
• store only submitted auth hashes and verification metadata, never the raw string
• block operator approval until onboarding auth evidence is verified
• keep signup unauthenticated and generic while preserving per-agent token access after approval
• update CLI signup, operator dashboard review, migrations, and docs

Verification

• npm run check
• npm run test
• npm run build