Analytics: GA4, Tag Manager and Search Console

Set up analytics and Search Console for [DOMAIN], doing everything you can
through gcloud and the Google APIs. Only stop for me where Google requires a
human, and when you do, give me the exact link, copy anything I need to paste
to my clipboard, and tell me precisely what to click.

1. Google Cloud: sign me in with gcloud (browser flow, my Google account
   [EMAIL]). Create a project called "websites" (or reuse it if it exists).
   Enable: Google Analytics Admin API, Google Analytics Data API, Tag Manager
   API, Search Console API, Site Verification API.

2. Service account: create one called "claude-websites", create a JSON key,
   save the whole JSON to my vault as GOOGLE_SERVICE_ACCOUNT_JSON, and delete
   the key file from disk. Never print it.

3. Search Console (no clicks from me): as the service account, get a DNS
   verification token from the Site Verification API for the domain, add the
   TXT record through the Cloudflare API, verify, and add the domain property
   to Search Console. Then add [EMAIL] as an owner so I can see it in my own
   Google account.

4. The two human steps. Walk me through them one at a time and wait for me:
   a. GA4: send me to create a Google Analytics account for [BUSINESS NAME]
      and accept the terms. The wizard insists on a property too: tell me to
      name it after the site and click through the rest with any answers,
      you'll fix the settings. Then have me add the service account email
      (copy it to my clipboard) as an Administrator under Account access
      management.
   b. GTM: send me to create a Tag Manager account for [BUSINESS NAME] with a
      Web container for [DOMAIN] and accept the terms. Then have me add the
      service account email with BOTH: account Administrator, and Publish on
      the container. (Account Administrator alone can't edit or publish the
      container.)

5. GA4 via API: set the property's time zone to [TIME ZONE] and currency to
   [CAD/USD], create a web data stream for https://[DOMAIN] with enhanced
   measurement on, and add [EMAIL] as an Administrator.

6. GTM via API: in the container, create a Google tag with the GA4
   measurement ID firing on all pages, and GA4 event tags for what matters on
   this site: form submissions as generate_lead, [phone and email clicks,
   booking link clicks, purchases...]. Fire the form event from a data layer
   push in the site code, not a click trigger that breaks on the next
   redesign. Publish the container with a clear version name.

7. Site: add GTM to the site properly for Next.js, production only. Add a
   cookie consent banner with Google Consent Mode v2, analytics denied by
   default until the visitor accepts, styled to match the site.

8. Mark generate_lead (and purchase, if the site sells) as key events.

9. Make sure sitemap.xml and robots.txt are right, and submit the sitemap
   to Search Console.

10. Deploy, load the live site, accept cookies, trigger the form event, and
    prove GA4 received it with the realtime report API.

Report: GA4 measurement ID, GTM container ID and published version, events
tracked, Search Console status, and the key's name in my vault.