feat(deploy): Cloudflare Workers deploy — single Worker serves SPA + API on KV

The directRunner is pure fetch, so the whole app runs serverless on Cloudflare
Workers (no Node host, no codex binary):
- src/backend/cloudflare/kvSessionStore.ts: handleCodexRequestKV wraps the core
  handler, hydrating each session's tokens from KV before the request and
  flushing back after (Workers are stateless across requests).
- deploy/cloudflare/worker.ts: one Worker — /api/codex/* via the KV handler +
  directRunner, everything else falls through to the ASSETS (SPA) binding.
- deploy/cloudflare/wrangler.jsonc: KV binding, SPA assets (run_worker_first
  /api/*), custom domain, workers_dev:false.
- deploy/cloudflare/README.md: setup + deploy steps.

Deployed live and verified end-to-end on Cloudflare: SPA serves, /session sets a
KV-backed signed cookie, /login/start returns a real device code from
auth.openai.com via directRunner — no CLI, no Node. 114 tests passing,
main typecheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sng-asyncfunc

.gitignore

@@ -5,3 +5,4 @@ dist/
 .DS_Store
 .claude/worktrees/
 demo/dist/
+deploy/cloudflare/public/

deploy/cloudflare/.wrangler/cache/cf.json

@@ -0,0 +1 @@
+{"httpProtocol":"HTTP/1.1","clientAcceptEncoding":"gzip, deflate, br","requestPriority":"","edgeRequestKeepAliveStatus":1,"requestHeaderNames":{},"clientTcpRtt":10,"clientQuicRtt":0,"colo":"MCI","asn":22773,"asOrganization":"Cox Communications","country":"US","isEUCountry":false,"city":"Omaha","continent":"NA","region":"Nebraska","regionCode":"NE","timezone":"America/Chicago","longitude":"-95.94043","latitude":"41.25626","postalCode":"68102","metroCode":"652","tlsVersion":"TLSv1.3","tlsCipher":"AEAD-AES256-GCM-SHA384","tlsClientRandom":"eYxep8BmoiGHmAGSPQxHiu3WT/cX44v7ObAVLzN+fuk=","tlsClientCiphersSha1":"JZtiTn8H/ntxORk+XXvU2EvNoz8=","tlsClientExtensionsSha1":"Y7DIC8A6G0/aXviZ8ie/xDbJb7g=","tlsClientExtensionsSha1Le":"6e+q3vPm88rSgMTN/h7WTTxQ2wQ=","tlsExportedAuthenticator":{"clientHandshake":"d86320bc9f0c42a1c642be211d9611f1ef3b89fafbb463b013b6c5f0e614639b9b6a04af5fa2604c81a93346a3f2df65","serverHandshake":"f029c808214a3b3e65c52a304c6ca62ba769c520eddff9167c92aa414dfd6e069d8cada30daac78d071ea63cffb8c5b6","clientFinished":"0b1916ea31801ba9767fb69636957b869310c490dfa11401ef44804459ce69a1bd4672ed7e42e7c443b7b0c833a59f5a","serverFinished":"614800b08cffd61b52d7768d55b47701d3545b80a768a819bd911c562f980d473bb8ec0e6b10bcaa8b2bc2a9c78b7d96"},"tlsClientHelloLength":"386","tlsClientAuth":{"certPresented":"0","certVerified":"NONE","certRevoked":"0","certIssuerDN":"","certSubjectDN":"","certIssuerDNRFC2253":"","certSubjectDNRFC2253":"","certIssuerDNLegacy":"","certSubjectDNLegacy":"","certSerial":"","certIssuerSerial":"","certSKI":"","certIssuerSKI":"","certFingerprintSHA1":"","certFingerprintSHA256":"","certNotBefore":"","certNotAfter":"","certRFC9440":"","certRFC9440TooLarge":false,"certChainRFC9440":"","certChainRFC9440TooLarge":false},"verifiedBotCategory":"","edgeL4":{"deliveryRate":268371},"botManagement":{"corporateProxy":false,"verifiedBot":false,"jsDetection":{"passed":false},"staticResource":false,"detectionIds":{},"score":99}}