feat: add Cloudflare account sync layer

[Turtle-Hwan]

Stacked dependency

• Builds on feat: add local-first stateless template storage and sharing #83 (feat/indexeddb-local-first)
• Merge feat: add local-first stateless template storage and sharing #83 first; then retarget this PR to main

What changed

• Replaces the KU email gate with verified Google OAuth for every Google account
• Keeps editing and persistence local-first, then syncs an IndexedDB outbox on login, page open, or manual request
• Adds account-scoped R2 objects, opaque rotating sessions, ETag writes, tombstones, conflict copies, quotas, and rate limiting
• Uses URL fragments for small shares and a 30-day R2 fallback only for large shares; Worker outages fall back to .linku.json
• Adds a manual Cloudflare deployment workflow and operations guide
• Uses no D1, KV, Durable Objects, Queue, or always-on server

Runtime secrets

Both values are configured as Worker secrets, not Vite variables:

• GOOGLE_CLIENT_ID
• GOOGLE_CLIENT_SECRET

The deployment workflow separately needs repository deployment credentials CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.

Safety boundaries

• Access token: chrome.storage.session, 15 minutes
• Refresh token: extension-only chrome.storage.local, 30 days
• Google sub is not stored; R2 keys use a SHA-256 opaque account ID
• Same Chrome profile cannot silently switch between different sync accounts
• Local saves complete before network sync and failed operations remain in the outbox
• Claude read-only review findings for pre-auth throttling, stale DELETE conflicts, and refresh lifetime were addressed

Validation

• pnpm run test:feedback — 3 passed
• pnpm run test:forms — 2 passed
• pnpm run test:todo — 4 passed
• pnpm run test:timetable — 10 passed
• pnpm run test:template-share — 5 passed
• pnpm run test:worker — 1 passed
• pnpm run build:local
• pnpm run build:gh-pages
• pnpm run build:worker — dry-run bundle gzip 9.24 KiB
• pnpm run lint
• Local Worker smoke: health 200, disallowed Origin 403, invalid bearer 401

Before production deployment

• Create the two R2 buckets and lifecycle rules documented in docs/SERVERLESS.md
• Create a LinKU-specific Google Web OAuth client and register the callback URL
• Store both Google values as Worker secrets
• Run the manual deployment workflow
• Verify Google account selection and two-profile sync in the unpacked extension

Not in this PR

Community publishing, search, likes, moderation, alerts, and the remaining legacy backend endpoints are not migrated. This PR establishes only the minimal account/session/template-sync layer.

[cloudflare-workers-and-pages]

Deploying linku with    Cloudflare Pages

Latest commit:	b49f2cc
Status:	🚫  Build failed.

View logs