Grant or revoke the admin role on one account.

This is how the second founder becomes an admin without touching env vars: the env-bootstrapped admin promotes their existing account once from the roster. Two roles only; every other role is provisioned by its own flow and must not be reachable from a console button. Self-demotion is refused so the console cannot lock its last operator out.