Prefer API token over username/password — scoped to least-privilege TerraformRole, reduces blast radius if credentials leak.
