Create or normalize the HRM and Keycloak business admin without rotating existing credentials. Fail auth startup when provisioning or mandatory MFA cannot be enforced, and let clean shared dev stacks reuse the platform service-account secret.