website: protect Store admin with Cloudflare Access

[fwerkor]

Replace the Snap Store administrator PIN/session layer with Cloudflare Access.

• protect the admin UI and APIs with the live CapOS Snap Admin Access application
• validate Cf-Access-Jwt-Assertion and the Access audience again inside the Worker
• disable workers.dev and preview URLs to reduce bypass surface
• remove PIN login/logout UI and API endpoints
• add a D1 migration that drops the legacy session/rate-limit tables
• remove PIN secret setup from the production bootstrap

The public storefront and /embed remain public. TypeScript, production build, Wrangler dry-run, secret scan, and local missing/invalid-JWT checks pass.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cloudflare-workers-and-pages]

Deploying capos with    Cloudflare Pages

Latest commit:	1a03795
Status:	✅  Deploy successful!
Preview URL:	https://3db3752f.capos.pages.dev
Branch Preview URL:	https://feat-snap-admin-cloudflare-a.capos.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	capos-snap	1a03795	Aug 19 2026, 02:36 PM