Tips and tricks for deploying JavaScript SPAs with runtime configuration

2FA adds security to your npm account but complicates the process of publishing from CI; here's one way around that