Startup flow now offers:
- [1] Deploy locally — config wizard, deploys on this server
- [2] Remote assistance — prompts for jumphost URL, user, password
(or SSH key path), opens reverse TLS:443 tunnel so a remote admin
can connect and run deployment through their terminal.
Tunnel now supports password auth in addition to key auth.