feat: close Cloudflare-native public quality loop

[XucroYuri]

Summary

• keeps the FreeLLMAPI key migration work: direct OpenAI-compatible providers, key-pool fallback, and Cloudflare Container secret wiring
• restores public translation backfill as a quota-bounded D1 workflow: dry-run candidate report, provider generation on execute, SQL export/execute, and explicit provider_quota_exhausted handling
• adds conservative Cloudflare public-read performance improvements: Worker Cache for default featured/all/bootstrap/facets/regions, HEAD support for public GET endpoints, Pages shell cache headers, and stable default home SEO
• adds Cloudflare-native ops scaffolding: scheduled Worker cron entries, D1 ops tables, Container internal task calls, health public_quality fields, and deploy-time live quality gate

Deployment Boundary

• this PR does not reintroduce VPS runtime dependency
• this PR does not cut apex DNS or claim a fresh production receipt for the new commits
• live rollout still needs the normal merge/deploy workflow, then the public-translation-backfill workflow with execute=true when provider quota is available

Verification

• ./.venv/bin/python -m pytest tests/unit/test_cloudflare_d1_backfill.py tests/unit/test_cloudflare_native_config.py tests/unit/test_public_translation.py tests/unit/test_cloudflare_live_quality_check.py -q --tb=short => 53 passed
• ./.venv/bin/python -m ruff check src/news_sentry/core/public_translation.py tools/cloudflare_d1_public_translation_backfill.py tools/cloudflare_d1_backfill.py tools/cloudflare_live_quality_check.py tests/unit/test_cloudflare_d1_backfill.py tests/unit/test_cloudflare_native_config.py tests/unit/test_cloudflare_live_quality_check.py tests/unit/test_public_translation.py => clean
• cd frontend/public && npm test -- src/App.test.tsx src/lib/api.test.ts src/lib/seo/site-seo.test.ts => 72 passed
• cd frontend/public && VITE_API_BASE=https://api.news-sentry.com npm run build => success
• cd frontend/cloudflare && npx wrangler deploy --env="" --dry-run --outdir /tmp/ns-worker-dry-run --containers-rollout none => success
• python tools/cloudflare_d1_public_translation_backfill.py --data-dir /tmp/news-sentry-no-data --targets france --limit 1 --daily-limit 1 --generate-missing --dry-run --output-sql /tmp/news-sentry-public-translation-empty.sql => dry-run receipt produced -- no public translation patches ready
• git diff --check => clean

Notes

• historical provider-key smoke/live details from the original PR remain valid for earlier commits, but the new quality-gate commits have not been deployed live yet
• if provider credits are exhausted, the translation workflow should now stop with an explicit blocker instead of silently succeeding

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[XucroYuri]

Cloudflare public-read snapshot closeout receipt (2026-06-28 UTC):\n\n- Added D1 public_read_snapshots and hot-path snapshot reads for default featured/all/bootstrap/facets/regions.\n- Remote D1 schema applied to ns-db; snapshot rows generated for all 5 fixed keys at 2026-06-28T16:15:59.664Z.\n- Worker deployed manually from this branch: version 0aa36d65-2277-4105-8024-2a8fdfea712f.\n- Live headers confirmed X-News-Sentry-Snapshot: hit and X-News-Sentry-Worker-Cache: hit for featured/bootstrap/facets.\n- PR CI is green on 76ff653.\n\nNot merged yet because production Deploy live quality still has the known PR2 blocker: public_quality.summary_ready=7 < 500. Local direct-path TTFB from this machine also remains mostly ~0.75-1.2s despite snapshot/cache hit, so the remaining latency is no longer D1 aggregation on these hot paths.