security: redact a live Cloudflare Global API Key from setup docs (#36)

`implementations/wokelang/CLOUDFLARE-SETUP.adoc` published a **live
Cloudflare Global API Key** as a literal value, in a **public**
repository, in a document telling the reader to paste it into GitHub
Actions secrets.

```adoc
1. **CLOUDFLARE_API_TOKEN**: Your Cloudflare API token
   - Value: `<redacted — a live Global API Key>`
```

A Global Key is **not scoped**. Paired with the account email it grants
full account access — every zone, all DNS, and billing.

## Scope of the exposure

The same key was also hardcoded in
`cloudflare-dns-terraform/auto-add-new-sites.sh` (removed in that repo's
#23). GitHub code search across the account now returns **this file as
the last remaining copy on a default branch**:

```
gh api -X GET search/code -f q="<key> user:hyperpolymath"  ->  total_count=1
```

## The change

Replaced with instructions to mint a **scoped** token (Cloudflare Pages:
Edit), an explicit warning against the Global Key, and a standing note
that credentials must never be written into this file — a setup document
should say *where* a secret goes, never *what* it is.

## ⚠️ Rotation is still required

This removes the key from the default branch, **not from history**. It
stays readable in earlier commits of this repo *and* of
`cloudflare-dns-terraform` — both public. Public repos are scraped
continuously; the key must be assumed compromised regardless of this
commit.

Owner actions:
1. **Roll the Global API Key** — Cloudflare -> My Profile -> API Tokens
-> Global API Key -> Change
2. Audit the Cloudflare **audit log** for unauthorised zone/DNS changes
3. Issue **scoped** tokens per project and set them as repo Actions
secrets

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

implementations/wokelang/CLOUDFLARE-SETUP.adoc

@@ -6,12 +6,20 @@
 
 Add these secrets to the GitHub repository:
 
-1. **CLOUDFLARE_API_TOKEN**: Your Cloudflare API token
-   - Value: `7a515ea1cffbff120f66cd08e6d3e41f02415`
+1. **CLOUDFLARE_API_TOKEN**: a *scoped* Cloudflare API token
+   - Create one at: https://dash.cloudflare.com/profile/api-tokens -> Create Token
+   - Scope it to the minimum this deployment needs (Cloudflare Pages: Edit)
+   - Do **not** use the account-wide *Global API Key*: it is not scoped, it
+     cannot be limited per-project, and paired with the account email it grants
+     full access to every zone, all DNS and billing.
    - Go to: https://github.com/hyperpolymath/wokelang-ssg/settings/secrets/actions
    - Click "New repository secret"
    - Name: `CLOUDFLARE_API_TOKEN`
-   - Value: (paste token above)
+   - Value: (paste your new scoped token)
+
+NOTE: never paste a credential into this file. Secrets belong in the
+repository's Actions secrets, and this document should only ever say *where*
+to put one, never *what* it is.
 
 2. **CLOUDFLARE_ACCOUNT_ID**: Your Cloudflare account ID
    - Find it at: https://dash.cloudflare.com/ → Click on your domain → Overview → Account ID (right sidebar)