Complete permissions during every bind and token path, expose effective access in the console, and keep the platform return path globally available.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add HMAC restore-by-host for phone-less rebind; resolve gateway at request time and recreate web after stack up.
Co-authored-by: Cursor <cursoragent@cursor.com>
