docs: set up lvwwd.org's production from scratch

[WillieCubed]

TL;DR

The steps pnpm bootstrap --production prints for lvwwd.org, and the matching set-up guide, now walk
a maintainer who has never touched Cloudflare, Google Workspace, Turnstile or Resend for this project
through creating every value from scratch, with the organization's real names spelled correctly
throughout.

Overview of Changes

Steps a first-time maintainer can follow

The printed steps now name the real Cloudflare Access team domain, lvbt.cloudflareaccess.com, kept
apart from the team name, and walk through creating what is missing from scratch: the wwd-admin
Google Group, the volunteer admin Access application in the order its page shows, the Turnstile
widget, the Resend domain and sending key, and the deploy token with the account and zone it needs.
Each step names the Cloudflare account exactly as its picker shows it.

Google sign-in spelled out in full

The set-up guide's Google Workspace section now lists every step with its exact values instead of
pointing to another guide: the Admin SDK API, "Trust internal apps," and the "Client ID" field
(an older Cloudflare UI calls this "App ID"). It and the ACCESS_AUD steps tell the person to join
the volunteer group before testing, and say "Create new application" sits at the top right even when
an account shows only its prerequisites list. The guide also names the LVBT Core Google Cloud project
to use, so no one guesses or creates a second one.

Matched to the dashboards once more

After the owner walked the same setup live, the Google Auth Platform "Get started" screen, reached
while creating the shared Cloudflare Access client, now spells out its four screens with the app name
and shared support address a maintainer actually sees. The Identity providers step warns that
"Cloud & SaaS" just above it in the sidebar is a different, unrelated feature, and says to leave SCIM
off and PKCE on. The volunteer admin policy step now says "Google Groups," the label the dashboard
shows, and the volunteer admin application gains an "Enable Binding Cookie" step. MFA stays a Google
setting, never a Cloudflare Access rule.

Paste each value before copying the next

The steps for lvwwd.org's secrets and the set-up guide now pair every copy with where to paste it
before the next value is copied: the Turnstile secret before its site key, the team domain alone, the
audience tag and tokens straight into the prompt, and the Web Analytics variable opened before its
token is copied. No step leaves a value sitting on the clipboard while another replaces it.

Correct names throughout

The guides previously named the Cloudflare account with a misspelling of the organization's name;
they now use "Las Vegans for Better Transit," the name the account is being renamed to. The deploy
token for CLOUDFLARE_API_TOKEN is now an account API token created under that account, scoped to
only the permissions lvwwd.org's deploy uses, so it keeps working after the person who created it
leaves.

Reruns and every value from scratch

The set-up guide now says what a second run of pnpm bootstrap --production does, how to replace a
value on purpose, and what to enter in each dashboard for a brand-new account: the team domain and
team name, Google Workspace sign-in, the wwd-admin group, the volunteer admin application, the
Turnstile widget, the setup and deploy tokens, Resend, and Cloudflare Web Analytics. It also says how
to add and remove a volunteer later.

Follow-ups

None.

🤖 Generated with Claude Code