Resolves the active setup token for first-run, creating one when missing.
Setup token string when first-run setup is pending; otherwise null.
Resolves the active setup token for first-run, creating one when missing.