Step 5: Set up the agent (and let it set up everything else)

Set this computer up so you can build, deploy and manage websites for me
end to end, without me pasting keys or clicking through dashboards. I want you
doing everything that can be done through a CLI or API. Only stop for me when a
human genuinely has to act (paying, accepting terms, a browser sign-in), and
when you do, tell me exactly what to click.

Where my keys are: Bitwarden Secrets Manager, project "websites". The machine
account access token is in my system keychain as "bitwarden-secrets-token"
(macOS Keychain generic password, or a Windows Credential Manager generic
credential). The machine account can read and write.

1. Tools: install whatever's missing: Node LTS, git, the GitHub CLI, wrangler,
   and the Bitwarden Secrets Manager CLI (bws). If npm blocks install scripts
   for packages like esbuild or workerd, approve them.

2. withkeys: create a helper command on my PATH called "withkeys" that reads
   the access token from the keychain and runs any command with the
   "websites" project's secrets as environment variables (bws run). It must
   never print a secret value. Also give yourself a safe way to save a new
   secret to the vault without the value appearing in the chat or in shell
   history.

3. GitHub: sign me in with the GitHub CLI using the browser flow, with the
   repo, workflow and delete_repo scopes. Tell me when to click Authorize.

4. Cloudflare: use CLOUDFLARE_BOOTSTRAP_TOKEN to create a new API token named
   "claude-websites", valid for one year, with Edit access to everything a
   website on Cloudflare can need: Workers (scripts, routes, builds, KV, R2,
   D1, queues, images, observability), Pages, DNS, zone settings, SSL,
   cache purge, email routing and email sending, Turnstile, and account
   settings, for all my accounts and all zones. The bootstrap token can't
   see my account ID, so use the account wildcard when you create it, then
   use the new token to look up the account ID. Get the exact permission
   group names from the API, don't guess them. Pipe the new token straight
   into the vault as CLOUDFLARE_API_TOKEN without printing it, and save my
   account ID as CLOUDFLARE_ACCOUNT_ID. Verify the new token can list my
   zones, Workers, D1 databases and R2 buckets.
   While the bootstrap token still exists, also create a second, narrower
   token for automatic deploys from GitHub: just what deploying a Worker
   needs (Workers scripts, routes, KV, D1, R2, account settings read). Save
   it as CLOUDFLARE_DEPLOY_TOKEN. That's the one that goes into GitHub, so
   the full-access token never leaves my vault. Then tell me the bootstrap
   token can be deleted.

5. My domain is [YOUR DOMAIN].
   - If it's already in my Cloudflare account, confirm it's active.
   - If it isn't, add it to Cloudflare, import its existing DNS records
     (check the MX, SPF and any verification records came across, so email
     keeps working), and give me the two nameservers to paste at my current
     registrar. Then keep checking until it's active.

6. Write a section into my global Claude instructions file
   (~/.claude/CLAUDE.md) so every future session knows: where my keys are,
   how to use withkeys, the secret names, my domain, and these rules:
   - Do the work yourself through CLIs and APIs. Don't send me into a
     dashboard for anything you can do.
   - Never print a secret, never write one to a file inside a project, never
     commit one. Secrets for deployed sites go into Cloudflare Worker secrets
     or GitHub Actions secrets, set from the vault. GitHub only ever gets
     CLOUDFLARE_DEPLOY_TOKEN, never CLOUDFLARE_API_TOKEN.
   - If a key is missing or lacks a permission, tell me the exact fix instead
     of working around it.
   - Deploy to a staging address first. Production only after I say yes.

Report: what works, what's missing, and anything I need to do.