Privacy-first control plane

Configure account metadata and service access. Every scan uses placement first, then the selected authorized origin.