🔐 Surface-A

Authorize the privileged device/OS actions Witan has queued — serve a model, restart a service, run a fleet script. Enter your passphrase to unlock a short session, then run each one. No terminal, no SSH.