Deploy Python/Streamlit app to Google Cloud Run — per-client instances, secure setup + handoff

I have a finished Python (Streamlit) web application that's built, tested, and containerized (Dockerfile and deploy script are ready). I need a DevOps/cloud engineer to deploy it securely to Google Cloud Run on my own Google Cloud account, and hand it back to me so I can run the minimal ongoing part myself. This is a bounded, one-time setup job — not software development. The app is done. I need the cloud infrastructure set up correctly and securely around it. What the app is: a marketing-measurement tool that reconciles a client's data into finance-ready outputs. It holds confidential business data but no personal or consumer data (no names, no PII). What I need — Tier 1 (priority: needed first, so I can safely serve one client): Google Cloud project set up, app deployed to Cloud Run, one separate instance per client Per-client data isolation — one client's instance and data can never reach another's (most security-critical piece) Client data in Google Cloud Storage (the app already reads/writes through a storage layer — just needs wiring to GCS by configuration, no code change) Client login/authentication so each client reaches only their own instance (Identity-Aware Proxy or equivalent) Admin password in Secret Manager, injected at runtime (never in code) Automated, verified, restorable backups of client data — some data cannot be reconstructed if lost, so this must be done right A clean per-client data-deletion process (the app already includes a deletion tool to wire up) A written access-teardown checklist so I can revoke your access and rotate all secrets after handoff Tier 2 (once Tier 1 is solid — hardening and repeatability): A repeatable, near-scripted process for onboarding each new client Base-image pinning and a patching cadence A short written runbook so I can handle minimal ongoing maintenance myself What I'll provide: the finished container (Dockerfile) and deploy script with clearly marked blanks for you to fill (project, region, bucket, service account, secret name), plus a detailed handoff document covering decisions already made, what's done, and exactly what's needed — so you can start without a long discovery phase. Deliverable: a secure, working deployment on my Google Cloud account, plus a short runbook and a handoff (including the access-teardown checklist) so I can run it going forward. Please tell me: your relevant Google Cloud Run experience (especially per-client isolation and secure deployment), your approach to backups and per-client isolation, and how you'd hand it over so you no longer retain access.