feat: self-host app updates on cloudflare

[leviFrosty]

Self-host app update delivery on Cloudflare with Hot Updater 1.0.2. Each of dev, beta and prod gets a separate Worker, D1 catalog and private R2 bucket. Only the authenticated client protocol is public; deployment and administration use provider credentials. The ordinary ww-api Worker remains unchanged.

Include the official schema, pinned adapters, environment-specific migration/deploy scripts and tag workflow. The matching WitnessWork PR #757 removes Expo Updates and must land after this backend half. Existing Expo Updates binaries require a new native build to switch providers.

All three environments are provisioned: Workers deployed, D1 schemas applied, client keys registered, and scoped R2 secrets installed. Credentials are saved in the Agents vault as WitnessWork OTA R2 (dev), WitnessWork OTA R2 (beta), WitnessWork OTA R2 (prod) and the account-scoped D1 Edit token WitnessWork OTA D1. No credential values are committed.

Validation:

• Backend CI passed: typecheck, 723 unit tests, and local end-to-end checks (38 passed; 3 provider-dependent skips).
• All three Worker builds and all six environment/platform protocol checks passed. Missing/invalid/cross-environment keys remain rejected after authenticated catalog requests; administration routes are not exposed.
• The persistent D1 token is active and can query all three schemas. Each R2 credential passed write/read, signed download and cross-bucket denial; temporary probe objects were removed.
• Dev and Beta Release apps on both iOS and Android downloaded and activated signed artifacts, rejected invalid RSA manifests while retaining their verified bundles, and rolled back to the built-in bundle. Cloudflare Insights recorded expected signature failures on all four surfaces. Evidence and screenshots are in the app PR.

Test signatures were restored and test releases disabled after verification. Production backend configuration and credentials are verified; production app native testing remains deferred. No production app OTA, upload or release was performed.