Generalize /shutdown endpoint to /status.
Stop polling for bootstrapped status over SSH; use status endpoint.

Kind of annoying for local dev though since `$CANONICAL_URL` isn't set.
Run Slamhound over all the namespaces.
Whitelist status endpoint in wrap-login.