feat: initialize panel access before linking Minecraft accounts

Configure connection and storage before creating or resuming the one-time Owner login. Remove Minecraft prerequisites from setup and preserve established login credentials.

Let staff preview and confirm roles from configured authentication sources using the existing account-link storage and game UUID mapping. Retain in-game code proof for players, add client-version and lobby guidance, and support NodePort passkey origins.

internal/platform/workloads.go

@@ -371,6 +371,8 @@ func APIDeployment(p Params) *appsv1.Deployment {
 	}
 	env = append(env,
 		corev1.EnvVar{Name: "FELIS_IMAGE", Value: p.FelisImage},
+		// Passkey origins must include the same public port the Service exposes.
+		corev1.EnvVar{Name: "FELIS_PANEL_NODEPORT", Value: fmt.Sprint(p.PanelNodePort)},
 		// The api's own internal-face base URL, so it derives the submission
 		// context URLs that build Pods fetch through it. Same value the login gate
 		// is handed; one address for one face.