Enterprise relay — user login + authenticator (TOTP)
Create the first Admin user and scan the authenticator QR.
Session lasts 30 minutes. Most users need the authenticator 6-digit code after password. Operations may require a fresh code when opened.