feat(telemetry): Cloudflare Worker + KV backend for opt-in relay telemetry (#34 infra)

[Narrator]

Summary

Implements the infra half of #34 per RFC 0002 §(4). Companion client work (relay startup POST, .domscribe/config.json flag, npx domscribe init prompt) is tracked separately as issue-34-client.

This PR delivers the server-side endpoint the relay client will POST to:

• POST /v1/session — single fire-and-forget endpoint, returns 204 on success, strict-schema validation, 1 KB body cap, ctx.waitUntil for background KV write
• GET /v1/wau/<YYYY-Www> — operator-only read of the WAU readout the DOP falsifier needs (≥10 weekly-active sessions by 2026-08-20). Gated on a constant-time token check; returns 404 when the secret is unset.
• GET /healthz — liveness check

Lives under infra/telemetry-worker/ (outside packages/*) so it does not touch the protocol package's SemVer surface or the release flow.

Acceptance — sprint 2491 issue-34-infra

• Cloudflare Worker deployed; KV namespace provisioned — wrangler.toml declares the SESSIONS KV binding; deployment runbook in README walks operator through wrangler login → wrangler kv:namespace create → wrangler deploy → smoke curl. Production id and preview_id are placeholder values to be filled by the deploying operator (they're scoped to a Cloudflare account and only meaningful with an auth token, so safe to commit).
• Write-rate ceiling tested — scripts/load-test.ts drives concurrent POSTs against the live endpoint and asserts p95 < 500ms, error_rate < 1%. README documents the headroom calculation: even at 100k WAU we are 14× under the 1000 writes/s KV ceiling. Per-key throttling is a non-issue because every session_id produces a unique key.
• 2 s timeout enforced on fire-and-forget POSTs — the request returns 204 immediately while the KV write completes via ctx.waitUntil. Worst case for the relay client is the 2 s socket timeout it owns; worst case for the Worker is the workerd CPU limit. Neither blocks the relay.
• Endpoint URL documented + Vercel rollback path — https://telemetry.domscribe.dev/v1/session. The rollback-vercel/ directory contains a behaviour-identical Vercel Edge Function backed by Vercel KV, activated per sprint 2491 replanning trigger chore(deps-dev): bump next from 16.1.6 to 16.1.7 #2 if Cloudflare provisioning blocks > 1 day. The CNAME swap is a DNS change; no code change in the relay.

Test plan

• pnpm test — 26 tests pass under @cloudflare/vitest-pool-workers (real workerd runtime + in-memory KV)
  • Schema strictness (unknown fields rejected = privacy guarantee)
  • Body cap via both declared content-length and streaming reader
  • KV write semantics (key partition by ISO week, idempotent duplicates, first_seen_at populated server-side)
  • Routing (404 / 405 with Allow: POST / /healthz)
  • Read endpoint auth (constant-time token check, 404 when disabled, 400 on malformed week)
  • ISO-week boundary cases (year-start/year-end, ISO 53-week years)
• pnpm typecheck — clean across both tsconfig.json (Worker code under workers-types) and tsconfig.scripts.json (load-test under node types)
• Operator action required — pnpm deploy against the live Cloudflare account (out-of-band; this PR cannot run wrangler against production from CI). Companion verification: issue-34-client smoke after deploy must produce ≥1 row in GET /v1/wau/....

Design notes worth surfacing

• ctx.waitUntil for fire-and-forget. Vercel Edge Functions don't have a direct equivalent — the rollback path awaits the write and relies on the relay's 2 s client-side timeout to bound latency. README spells out this trade-off.
• Session ID as the KV key partition, not a stored field. Means the WAU readout is a prefix-scan with no read-modify-write step; duplicate POSTs are idempotent overwrites.
• first_seen_at resets on each POST. If we need true first-contact semantics we'd add one KV read per request. I opted out of that to keep the per-request cost at exactly one KV write.
• Unknown-field rejection (z.object().strict()). This is the privacy guarantee. A relay that adds a new field is rejected with 400 until the schema is bumped here in lockstep — accidental leakage by silent field-addition is structurally impossible.

Out of scope (delivered by issue-34-client)

• Relay startup POST + 24h interval
• .domscribe/config.json telemetry.enabled flag (default off)
• npx domscribe init opt-in prompt with payload shown inline
• README privacy paragraph on the relay side

Refs: RFC 0002 §(4), sprint 2491 plan, DOP falsifier signal (c)