Expose an authenticated idempotent Cloudflare site provisioning API

[chubes4]

Parent: #1970

Goal

Expose the remote API that creates an isolated editable WordPress site from a verified artifact and returns durable status/claim URLs.

Scope

• POST /v1/sites
• GET /v1/sites/{siteId}
• GET /v1/sites/{siteId}/operations/{operationId}
• POST /v1/sites/{siteId}/imports
• bearer authorization, explicit scopes, idempotency keys, quotas, and bounded request schemas
• hostname allocation and one-time administrator claim tokens
• stable error and operation receipt schemas

Acceptance

Remote callers receive 202 Accepted, can poll durable progress, and obtain an isolated ready site URL plus one-time admin claim flow. Unauthorized, replayed, oversized, or cross-site requests fail deterministically without state mutation.

[chubes4]

PR #1999 merged the authenticated provisioning API core: scoped bearer auth, configured-context allocation, imports, durable operation status, quotas, and crash recovery.

The one-time administrator claim flow remains intentionally outstanding from this issue's acceptance criteria. Reopening #1971 until that second security boundary is implemented and verified.