#Auth.js

Shipping to Cloud Run: Slack SSO, an IP Allowlist, and Keyless CI/CD

Deploying the still-mock-backed app to Cloud Run gated two ways (Slack SSO at the app layer and an office-IP allowlist) with a standalone container and keyless GitHub Actions via Workload Identity Federation. Plus the cost call between an app-layer IP check and Cloud Armor, and the auth gate that forced collapsing an internal self-fetch.