Performs the fresh-install initialization of a FedRAMP instance: creates the initial federated
account, records the activation code and Jamf Pro URL, acknowledges the EULA, persists the tenant's
OIDC broker (Keycloak) configuration UUID, and enables FedRAMP SSO.
Run-once operation: allowed only on a FedRAMP instance, while no JSS users exist, the broker is
enabled, and no broker UUID is already stored. Gated by the activation code, matching the sibling
init endpoints. Non-FedRAMP instances are rejected with INVALID_STATE.