KISS. Use two connectors, one with a precharge resistor to be connected first, then another for the bulk current. By the time the operator has time to connect the second connector, the caps should be safely charged.
If you need to add BFU protection, add some additional pins or some other security measure to the main connector so that the whole thing would not run without the main connector actually connected. It will not protect the contacts if you plug the main connector first, but at least it wont destroy the precharge resistor if run only from the first connector.
Or if you can find one, get a connector that has shorter and longer pins, so that the precharge ping goes in first and then the main power pin, like SATA does.