Thanks for your replying. I made some progress but not havent deployed yet.
gcloud iam service-accounts get-iam-policy firstname.lastname@example.org will show the roles for the account. What are the roles you see ? Mine was none with etag information. So if you click permissions (in your second screen-capture) — service account email with permissions can be added. But still same problem existed.
Enabling —— log-http printed out google app engine admin api to be enabled. Once that is done — app deploy crashes!