Add authenticated Cloudflare provisioning API core

[chubes4]

Summary

• add a D1-only /v1 control API for configured-site allocation, site status, imports, and durable operation status
• authenticate digest-configured bearer principals with explicit scopes, expiry, site grants, and per-principal quotas
• validate neutral staged artifacts before allocation, then reserve the shared site identity transactionally so existing/operator sites cannot be taken over
• recover interrupted artifact copies, operation creation, and API ownership links through scheduled execution
• fail closed for cross-principal, restricted-site, and unlinked operation reads while preserving legacy operator and Durable Object behavior

Split scope

This is the API-core portion of #1971. Administrator claim issuance/redemption is intentionally excluded and will follow in a second PR after this control-plane boundary merges. This PR does not close #1971.

Verification

• npm run test:cloudflare-runtime (15 focused provisioning tests plus existing runtime suites)
• npm run test:cloudflare-wordpress-auth
• npm run cloudflare:dry-run
• npm run cloudflare:dry-run:d1
• git diff --check origin/main...HEAD

Part of #1971

AI assistance

OpenAI gpt-5.6-sol was used through OpenCode to inspect the existing Cloudflare architecture, draft the implementation and tests, and perform adversarial reviews of allocation, recovery, R2, and authorization races. Chris Huber reviewed the resulting behavior, verification evidence, and commit.