Founder-approved: valid badge + armed input_boolean -> rest_command fires the pfvsvrpi doorctl endpoint (Tailscale-bound, token+source allowlisted, self-securing relay). Disarm = boolean off = log-only. URL secret on-box only (doorman_unlock_url). https://projects.knownelement.com/issues/345