Memberberry platform operations

Set up the first operator

This one-time setup establishes a separate platform identity. It does not grant customer access and cannot be used again after MFA verification succeeds.