Separate from user accounts. Requires password, ML-DSA-87 signature from your local private key/PEM (private key never uploaded), and TOTP. No public admin registration endpoint.
Password accepted. Sign the challenge with your ML-DSA-87 private key (locally).
Signature accepted. Enter TOTP.
Select your ML-DSA-87 private PEM (seed-only PKCS#8 recommended). The private key is used locally in this browser session only.