feat(security): mirror anti-DDoS blocks to Cloudflare edge via API

- gate creates a zone IP Access Rule (block) for proxied offenders that hit the block threshold, deduped until the tiered block expires
- cloudflare-api lib: verified endpoints, create/delete/verify/list helpers, Redis-backed tracking + 30s TTL sweep (instrumentation worker + admin render)
- runtime toggle cloudflareAutoBlock in antiddos config; boot default CLOUDFLARE_AUTO_BLOCK_ENABLED
- admin panel: Cloudflare edge-blocks card with verify + remove-rule actions; unban also lifts the edge block
- credentials live in env only (CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID)

src/env.ts

@@ -132,6 +132,22 @@ const schema = z
 		// Logging level.
 		LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).optional(),
 		APP_VERSION: z.string().optional(),
+		// Cloudflare API — optional. When the API token + zone id are set, the
+		// anti-DDoS gate can automatically mirror escalated IP blocks to the
+		// zone's IP Access Rules so attackers are dropped at the edge. The token
+		// lives in env only and is never persisted into Redis-visible config.
+		CLOUDFLARE_API_BASE_URL: z
+			.string()
+			.url()
+			.default("https://api.cloudflare.com/client/v4"),
+		CLOUDFLARE_API_TOKEN: z.string().optional(),
+		CLOUDFLARE_ZONE_ID: z.string().optional(),
+		// Boot default for the runtime "auto-create Cloudflare blocks" toggle
+		// (overridable via the admin panel / antiddos:config).
+		CLOUDFLARE_AUTO_BLOCK_ENABLED: z
+			.string()
+			.optional()
+			.transform((value) => value !== "false" && value !== "0"),
 	})
 	.superRefine((data, ctx) => {
 		if (data.NODE_ENV !== "production") return;