deploy: Cloudflare Workers + Pages, domain, secrets, CI

[lex00]

Stand up the deployed app. Depends on chant being published (INTENTIUS/chant#431) so we can drop the file: deps.

Scope

• Worker: wrangler deploy for src/handler.ts. Bind STATS KV (rate limit + counter); set secrets GIT_TOKEN and TURNSTILE_SECRET.
• SPA: build web/ and deploy web/dist to Cloudflare Pages. Set VITE_API_BASE (the Worker URL) and VITE_TURNSTILE_SITEKEY at build time.
• Domain: wire blacklight.intentius.io (Pages) and route /audit to the Worker (custom domain or a route).
• Deps: replace file:/…/chant/* with the published @intentius/chant* range.
• CI (GitHub Actions): on PR run just check + just e2e + just e2e-browser; on merge to main, deploy Worker + Pages.

Acceptance

• https://blacklight.intentius.io serves the SPA; a real public-repo audit returns a report.
• Worker has KV + secrets; rate limit + Turnstile active in prod.
• CI deploys on merge; README documents the one-command deploy + ~$0 idle cost model.

[lex00]

DNS finding: intentius.io is on GoDaddy nameservers (ns41/ns42.domaincontrol.com) with the apex on GitHub Pages (185.199.108.x — the chant docs). Cloudflare Worker custom domains require the zone on Cloudflare, so custom_domain = true can't provision blacklight.intentius.io while the apex stays on GoDaddy.

Chosen path: keep the apex on GoDaddy; delegate only the blacklight subdomain to Cloudflare (subdomain NS delegation — free, reuses the custom_domain config in wrangler.toml).

Steps:

1. Cloudflare → Add site blacklight.intentius.io (subdomain zone, Free). Note the two assigned nameservers.
2. GoDaddy (intentius.io DNS) → add two NS records, host blacklight, → the Cloudflare nameservers.
3. After delegation propagates, the Workers Builds deploy auto-provisions the A record + TLS cert; worker live at https://blacklight.intentius.io.
4. Bind the STATS KV namespace (turns on the anonymous counter + rate limiting).

Note: deploys fail until the subdomain zone exists on Cloudflare (zone-not-found); last good workers.dev deploy stays live in the meantime.

[lex00]

Update: Cloudflare subdomain zones are Enterprise-only, so blacklight.intentius.io on Free would require moving the whole intentius.io zone onto Cloudflare (the apex is on GoDaddy + GitHub Pages docs). Deferred for now.

For launch, serving at blacklight.intentius.workers.dev (account subdomain renamed to intentius; custom_domain config dropped in #11). The branded domain stays open here as the eventual upgrade — move the zone to Cloudflare (docs keep working via DNS-only GitHub Pages records), then re-add the custom_domain route.