feat(deploy): add production readiness scaffolding

[Tuxedolphin]

Summary

• add Cloudflare Pages static rules and a Cloudflare Worker API proxy scaffold
• add configurable backend CORS support with integration coverage
• fix rendered accessibility issues found by axe and keep the broader test lint gate clean
• document the Pages/API/Worker deployment path

Verification

• uv run --python 3.13 pytest tests/ (825 passed)
• uv run --python 3.13 ruff check backend tests
• pnpm lint
• pnpm test (23 passed)
• pnpm build
• pnpm audit --audit-level moderate
• npx --yes @axe-core/cli http://localhost:5174 --exit (0 violations)
• npx --yes wrangler@latest deploy --dry-run --config deploy\\cloudflare-api-proxy\\wrangler.jsonc
• workflow YAML parse and git diff --check

Notes

• GitHub branch protection could not be configured from this token; the branch protection API returned 404 for the main branch protection endpoint.