Operator-only access
Google OAuth requires GOOGLE_OAUTH_CLIENT_ID + GOOGLE_OAUTH_CLIENT_SECRET wrangler secrets to be set; otherwise the magic-link flow above is the only path.
GOOGLE_OAUTH_CLIENT_ID
GOOGLE_OAUTH_CLIENT_SECRET