Cloud Run deploy (Phase 3c)

Operator runbook for a cost-aware Cloud Run service plus Cloud Scheduler inbox poll.

Full PowerShell steps: scripts/cloudrun/deploy.md (local clone: same path).

Goals

Goal	Approach
Lower cost	min-instances=0, 2-hour Scheduler while testing, 4 vCPU / 8 GiB with LOINC
Ship assets	GCS /data + /assets; image has no FAISS/catalog
Org browser access	--allow-unauthenticated + cookie login (APP_AUTH_*); poll still token-gated
Local GCP key	faxautomation/secrets/gcp-sa.json (gitignored)
Docs	https://faxautomation.pages.dev/ (Cloudflare only; no GitHub Pages workflow)
App URL	*.run.app until fax.doctortro.com domain mapping

Architecture (summary)

Cloudflare Pages (docs only)  https://faxautomation.pages.dev/

Browser → /login (cookie) → Cloud Run harness
Cloud Scheduler (OIDC + poll token) → /internal/inbox/poll

Security

1. Share login password out of band — never on the docs site.
2. /loinc-review is harness learning, not the production MA chart UI (that is Elation).
3. Never commit gcp-sa.json or Elation / app-auth secrets.
4. Poll endpoint requires X-Inbox-Poll-Token.
5. Phase 4 is VPC + PGA without Cloud NAT (no extra NAT bill). Full default-deny is later.

After deploy

. .\scripts\cloudrun\operator.env.ps1
Invoke-RestMethod -Uri "$ServiceUrl/health"

Open $ServiceUrl → sign in. Custom domain later via Cloud Run domain mapping.