feat(security): mirror anti-DDoS blocks to Cloudflare edge via API

- gate creates a zone IP Access Rule (block) for proxied offenders that hit the block threshold, deduped until the tiered block expires
- cloudflare-api lib: verified endpoints, create/delete/verify/list helpers, Redis-backed tracking + 30s TTL sweep (instrumentation worker + admin render)
- runtime toggle cloudflareAutoBlock in antiddos config; boot default CLOUDFLARE_AUTO_BLOCK_ENABLED
- admin panel: Cloudflare edge-blocks card with verify + remove-rule actions; unban also lifts the edge block
- credentials live in env only (CLOUDFLARE_API_TOKEN / CLOUDFLARE_ZONE_ID)

src/instrumentation.ts

@@ -34,4 +34,9 @@ export async function register() {
 		void drainFurnitureImports();
 	}, 30000);
 	timer.unref();
+	const { sweepExpiredCloudflareBlocks } = await import("@/lib/cloudflare-api");
+	const cloudflareSweep = setInterval(() => {
+		void sweepExpiredCloudflareBlocks();
+	}, 30000);
+	cloudflareSweep.unref();
 }