Request access

This mirrors the private-alpha flow: the app owner receives the request, then creates or approves access when ready.