Go to console.cloud.google.com → New Project → Enable "Google Sheets API" → IAM & Admin → Service Accounts → Create → Download JSON key file. Copy the client_email and private_key values.

In your Google Sheet, click Share and add the service account email (ends in @...iam.gserviceaccount.com) as a Viewer. The sheet stays private — only this robot account can read it.

Go to workers.cloudflare.com → Create Worker → paste the contents of bybaby-worker.js → Deploy. Then go to Settings → Variables and add:

GOOGLE_SERVICE_ACCOUNT_EMAIL = client_email from JSON
GOOGLE_PRIVATE_KEY = private_key from JSON
SHEET_ID = the ID from your Google Sheet URL
AUTH_JWT_SECRET = long random secret
AUTH_USERS_JSON = JSON array of accounts, e.g. [{"username":"m1","password":"…","role":"manager"},{"username":"s1","password":"…","role":"staff"}] (any number of managers/staff). Alternatively use legacy MANAGER_USERNAME / MANAGER_PASSWORD and STAFF_USERNAME / STAFF_PASSWORD.
ALLOWED_ORIGINS = your Pages URL(s), comma-separated

Host index.html on Cloudflare Pages. In the app script, set the WORKER_BASE_URL constant to your Worker origin (no trailing slash). Add that Pages URL to ALLOWED_ORIGINS on the Worker. Sign-in uses POST /auth; sync uses GET /sheet with a Bearer token. Sending a quote uses POST /send-quote (Resend): configure RESEND_API_KEY and MAIL_FROM on the Worker.

Your Google Sheet must have tabs named exactly:
DS-SILHOUETTES, DS-GEMSTONES, DS-METALS, DS-WEIGHT ADJUSTMENTS