pub fn install(file: PathBuf) -> Result<()>
Create the token and write it owner-only. Call once at start.