House style: the principal identity is named (reachableceo), never 'the founder'. No behavior change. https://projects.knownelement.com/issues/942
Policy rulings (#942): unique passwords, Cloudron-only SSO accounts, no reachableceo credentials, TOTP seeds MUST be captured to the vault. Cloudron admin API wrapper, cookie-jar OIDC login, RFC-6238-tested TOTP helper, per-system SSO/API references, incident log.