Integrate and production-harden the Cloudflare Worker backend

[support371]

Objective

Port the existing devin/1778454818-cloudflare-worker-backend implementation onto the current main branch, remediate its verification gaps, and prepare a safe Cloudflare deployment for GEM Enterprise.

Acceptance criteria

• Cloudflare Worker backend is integrated from current main, not deployed from the stale branch.
• Worker TypeScript check passes.
• Unit/integration tests cover health, authentication failure, authorization failure, input validation, and fail-closed optional bindings.
• Wrangler configuration uses explicit production and staging targets with a current compatibility date.
• D1 migration is validated locally before any owner-approved remote application.
• R2/KV-dependent routes fail closed until the bindings exist; no sensitive upload is enabled prematurely.
• Deployment workflow runs validation on pull requests and deploys only after owner-approved configuration.
• Production secrets remain in Cloudflare/GitHub secret stores and are never committed or logged.
• Dry-run bundle succeeds and the deployment/rollback runbook is current.
• Current frontend integration and canonical Vercel deployment remain unaffected.

Exclusions / safety gates

• No paid service activation.
• No direct commit to main.
• No production D1 migration, Worker deployment, DNS/custom-domain change, or secret mutation without owner authorization and Cloudflare OAuth.
• No enabling document/KYC uploads until private storage, validation, malware scanning, access control, audit logging, retention, and deletion are verified.

Known findings

• Existing Worker branch last changed on 2026-05-11 and was never merged into current main.
• TypeScript currently passes.
• Wrangler dry-run currently bundles successfully.
• Worker test command currently fails because there are no Worker tests and it resolves the root Vitest configuration.
• Current deployment script warns because it does not select an explicit Wrangler environment.

Rollback

Keep the Worker isolated under cloudflare-worker/. Revert the integration PR or roll back the Cloudflare Worker version without changing the Vercel-hosted frontend or production domain.

[support371]

Implementation plan

1. Port the two existing Worker commits onto a focused branch based on current main and preserve current Vercel governance.
2. Replace stale signature-only Worker authentication with fail-closed validation against the canonical GEM session authority.
3. Remove deployment credentials from Worker runtime secrets; keep them only in deployment secret stores.
4. Keep KYC/document/high-impact mutations disabled until their required controls and bindings exist.
5. Correct authorization, ownership, input-validation, pagination, CORS, audit, and environment-selection gaps.
6. Migrate to wrangler.jsonc, generate binding types, enable observability, and use explicit production/staging commands.
7. Add Cloudflare Workers Vitest integration with D1 migration-backed tests.
8. Add PR validation plus manual, confirmation-gated deployment workflow.
9. Run type checking, tests, migration validation, Wrangler types, and production/staging dry-runs; document any account-only steps and rollback.