ci: add Cloudflare Pages deploy workflow for web/ sites

Matrix job builds and deploys each of the four sites (landing, blog,
guides, api) via cloudflare/wrangler-action on push to develop (production
deploy) and on PRs (preview deploy with a unique URL).

Path filter limits runs to actual web/ changes. Concurrency group
cancels in-progress deploys when newer commits land.

Requires two repo secrets:
- CLOUDFLARE_API_TOKEN (Pages:Edit on this account)
- CLOUDFLARE_ACCOUNT_ID

Author: bpamiri

.github/workflows/web-deploy.yml

@@ -0,0 +1,64 @@
+name: Deploy static sites
+
+on:
+  push:
+    branches: [develop]
+    paths:
+      - 'web/**'
+      - '.github/workflows/web-deploy.yml'
+  pull_request:
+    branches: [develop]
+    paths:
+      - 'web/**'
+      - '.github/workflows/web-deploy.yml'
+
+concurrency:
+  group: web-deploy-${{ matrix.site }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Deploy ${{ matrix.site }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      deployments: write
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        site: [landing, blog, guides, api]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.23.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: web
+        run: pnpm install --frozen-lockfile
+
+      - name: Build ${{ matrix.site }}
+        working-directory: web
+        run: pnpm --filter @wheels-dev/site-${{ matrix.site }} build
+
+      - name: Deploy to Cloudflare Pages
+        uses: cloudflare/wrangler-action@v3
+        env:
+          # Untrusted inputs — pass via env to prevent command injection
+          DEPLOY_BRANCH: ${{ github.head_ref || github.ref_name }}
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy web/sites/${{ matrix.site }}/dist --project-name=wheels-${{ matrix.site }} --branch="$DEPLOY_BRANCH" --commit-hash="$GITHUB_SHA"