Docs: mention the second credential delivery mode (deliveryMode: 'reveal') #34

Found while integrating cadeom (api.cadeom.unlikeotherai.com) against UOA, working from the integration guide at /llm. Each item below was verified against the UOA source, not inferred from behaviour.

The onboarding section describes approval followed by a one-time claim link emailed to contact_email. There is a second mode in the source — deliveryMode: 'reveal' — where the superuser sees the credentials once and passes them on out of band.

This matters for planning an integration: the emailed-claim-link path assumes the integrator controls contact_email and can receive mail, which is not always true for a staging or internal environment.

Ask: document both modes and when each is used.

Related, and worth stating prominently somewhere near the top: onboarding requires a human superuser approval per domain, per environment, and there is no bypass (no seed, no dev bootstrap — DEBUG_ENABLED only unlocks /config/verify). Also, config_url and jwks_url must be publicly reachable, so a VPN-only or localhost environment cannot be onboarded at all. Both are entirely reasonable constraints, but they are architectural facts an integrator needs on day one, not day three.