Connector
Install and enroll the connector
Generate a one-time enrollment token, start the connector inside the private network, and let it exchange the token for a long-lived connector credential stored locally.
Token contains no permanent secret
Credential fingerprint shown in UI
Revocation blocks reconnect
Health diagnostics stay local