Move Okta configuration between tenants without the guesswork.

• Invitation-only. No public registration, and repeated failures lock the account.
• Authenticator-app two-factor is mandatory for every session.
• Okta API tokens are encrypted at rest and never sent back to the browser.