Slug of a pending row in admin.tenants whose Tofu onboarding (tenants/<slug>.tf) already ran — reads its Zitadel secret from Secret Manager and activates it.
pending
admin.tenants
tenants/<slug>.tf