Create a setup link to forward to the domain's DNS admin

The person who starts a connect flow is often not the person who can edit DNS. This mints a SECOND, narrower link for that person: setupUrl opens a page showing the integrator's branding, the domain, the exact records to add and a Verify button — and nothing else. No one-click flow, no returnUrl back into your product, and never the dd_sess_ session token itself, so it is safe to forward to a stranger in a way the connect link is not.

Authorized by the session token, exactly like verify, so the hosted page calls it from the browser and your server can call it with the token it minted. The link lives exactly as long as the session (expiresAt is the session's) and answers 410 expired with it. Calling this again ROTATES the link: the previous setupUrl stops resolving the moment the new one is returned — there is never more than one live setup link per session.

A verify pressed from the setup page finalizes the connection and fires connection.verified / session.completed exactly as a verify from the hosted page does; the only trace of which door was used is on the session's attempt log in the dashboard.