Like... hear me out. Login is already going to use atproto oauth. We create a space for each instance. Wanna give somebody else access to manipulate your instance? Add 'em to the space! Instance config can also live in spaces.
Guys, I think I'm about to build an infrastructure SaaS on atproto. 🤣