chore: Cloudflare deploy cutover + post-migration follow-ups (#19)

[ggfevans]

Summary

Remaining steps to take the docs site live on Cloudflare Workers after the stack refresh + deploy migration in #19, plus deferred hardening and one content fix.

Motivation

#19 refreshes the stack (Astro 5→7, Starlight 0.37→0.41, sharp 0.34→0.35; npm audit 15→0) and migrates the deploy from the decommissioned self-hosted rsync host to Cloudflare Workers static assets (wrangler.jsonc + cloudflare/wrangler-action). The branch is verified (build, dev server, wrangler --dry-run), but the live deploy is gated on Cloudflare credentials only the maintainer can set.

Acceptance Criteria

🚦 Blocker — the deploy cannot run without this

• Add repo secret CLOUDFLARE_API_TOKEN, scoped Workers Scripts: Edit + Zone: DNS Edit + Zone: Workers Routes: Edit, limited to the racku.la zone
• Add repo secret CLOUDFLARE_ACCOUNT_ID

Cutover

• Merge chore: refresh stack to Astro 7, migrate deploy to Cloudflare Workers #19
• Confirm the Deploy Docs workflow succeeds on push to main
• Verify custom_domain provisions docs.racku.la (DNS currently empty; racku.la is already a Cloudflare zone) and the site serves from Workers
• Confirm the Dependabot alerts on main clear after merge

Hardening / follow-ups

• Enable HSTS at the Cloudflare zone level (SSL/TLS → Edge Certificates)
• (Deferred) Author a full enforcing Content-Security-Policy in public/_headers, tested against Starlight inline styles, Google Fonts, and Pagefind search
• Content fix: change the ```caddy code fence to ```caddyfile in src/content/docs/self-hosting/docker.mdx (invalid Shiki language → silently falls back to plain text)

Technical Notes

• The custom-domain DNS record requires Zone: DNS Edit on the token — the default "Edit Cloudflare Workers" template omits it, so a successful asset upload would still fail at the domain attach. Verified against Cloudflare docs.
• public/_headers already ships a conservative, theme-safe set (nosniff, Referrer-Policy, X-Frame-Options: DENY, CSP frame-ancestors). The deferred item is only the full script-src/style-src CSP.

---

Captured via /create-issue (repo retargeted from www → docs).