feat: initialize panel access before linking Minecraft accounts

Configure connection and storage before creating or resuming the one-time Owner login. Remove Minecraft prerequisites from setup and preserve established login credentials.

Let staff preview and confirm roles from configured authentication sources using the existing account-link storage and game UUID mapping. Retain in-game code proof for players, add client-version and lobby guidance, and support NodePort passkey origins.

internal/platform/workloads_test.go

@@ -331,6 +331,15 @@ func TestAPIService_NodePort(t *testing.T) {
 	p.PanelNodePort = 30445
 	svc := apiService(p)
 	dep := APIDeployment(p)
+	foundPort := false
+	for _, env := range dep.Spec.Template.Spec.Containers[0].Env {
+		if env.Name == "FELIS_PANEL_NODEPORT" {
+			foundPort = env.Value == "30445"
+		}
+	}
+	if !foundPort {
+		t.Fatal("API passkey origins do not know the Service's public NodePort")
+	}
 
 	if svc.Name != SAAPI || svc.Namespace != p.ControlNamespace {
 		t.Errorf("api Service = %s/%s, want %s/%s", svc.Namespace, svc.Name, p.ControlNamespace, SAAPI)