Reveal the encryption key ONCE, for the wizard’s record-your-key step
(the wizard holds an admin session right after POST /auth/setup). 410 Gone
after acknowledgment bounds the exposure window — afterwards the key lives
only in the operator’s environment.