Use ADMIN_PASSWORD from .env.
Start device login, approve in browser, then poll to save the upstream key.