fix(ops): wire Fivetran secrets and connection env on Cloud Run deploy

Mount FIVETRAN_API_KEY/SECRET from Secret Manager by default, pass
connection IDs and ALLOW_WRITES at deploy time, and support optional
min-instances. Correct dbt deployment.yml comment (GCS not Sheets).

Author: samartho4

backend/deployment/deploy.py

@@ -59,6 +59,7 @@
     "ARTIFACT_BUCKET", "DRYLAB_PROVENANCE_BUCKET", "BQ_DATASET",
     "MEMORY_SERVICE_URI", "FIVETRAN_TRANSFORMATION_ID", "LAB_ENDPOINT_URL",
     "FIVETRAN_ACTIVATION_ID", "FIVETRAN_ACTIVATION_BASE_URL", "FIVETRAN_ACTIVATION_TARGET",
+    "FIVETRAN_CONNECTION_ID", "FIVETRAN_SAMPLES_CONNECTION_ID", "FIVETRAN_ALLOW_WRITES",
 )
 
 # Secret Manager refs injected as env at deploy: {ENV_VAR: secret_name}. SESSION_SERVICE_URI is pulled from a
@@ -75,6 +76,9 @@
 _activation_token_secret = os.environ.get("CENSUS_TOKEN_SECRET", "drylab-activation-token")
 if os.environ.get("WIRE_ACTIVATION_SECRET") == "1":
     _SECRET_REFS["FIVETRAN_ACTIVATION_TOKEN"] = _activation_token_secret
+if os.environ.get("WIRE_FIVETRAN_SECRETS", "1") != "0":
+    _SECRET_REFS["FIVETRAN_API_KEY"] = os.environ.get("FIVETRAN_API_KEY_SECRET", "fivetran-api-key")
+    _SECRET_REFS["FIVETRAN_API_SECRET"] = os.environ.get("FIVETRAN_API_SECRET_SECRET", "fivetran-api-secret")
 
 _project_number_cache: dict[str, str] = {}
 
@@ -148,6 +152,9 @@ def _commands() -> list[list[str]]:
         "--cpu", "2",
         "--timeout", "3600",            # an SSE turn (full loop) can run minutes; default 300s would cut it off
     ]
+    min_inst = os.environ.get("CLOUD_RUN_MIN_INSTANCES")
+    if min_inst:
+        deploy += ["--min-instances", min_inst]
     if env_pairs:
         deploy += ["--set-env-vars", ",".join(env_pairs)]
     if secret_pairs:

transformations/dry_lab_dbt/deployment.yml

@@ -1,7 +1,7 @@
 # Fivetran Transformations for dbt Core — job + schedule (infrastructure-as-code for the transform edge).
 # Docs: https://fivetran.com/docs/transformations/dbt/setup-guide/deployment-yaml-file
-# The "integrated" schedule runs this transform automatically AFTER the upstream Sheets connectors sync.
-# Fill the connection IDs once the Fivetran Google Sheets connectors exist (see docs/DATA_SPINE.md).
+# The "integrated" schedule runs this transform automatically AFTER the upstream GCS connectors sync.
+# Connection IDs below match the live Fivetran GCS → BigQuery spine (see docs/DATA_SPINE.md).
 jobs:
   - name: dry_lab_spine
     schedule: