Configured on screen, not by editing .env — with a PIN locking setup and settings behind it.
Eight steps with a progress bar that remembers where you stopped. Only storage is required — Wi-Fi, assistant, Home Assistant, notifications, Extras, serial and licence can each be skipped and finished later in Settings.
Unlocking sets a signed, http-only cookie for 8 hours. Five wrong attempts lock further tries for 15 minutes.