feat: provision cloudflare workers and pin db pool per isolate

[FrkAk]

Summary

Task Reference: [MYMR-165]

Provisions the Cloudflare Workers production environment for app.mymir.dev and addresses runtime regressions surfaced during the first deploy. Beta is now live.

• Cloudflare resources provisioned: R2 bucket, KV namespace, D1 database, two rate-limit bindings, MymirBroker Durable Object, Custom Domain attachment.
• Refactors the Neon Pool to a per-isolate singleton with maxUses: 1 connections to fix the React Server Components streaming race against pool.end() ("Cannot use a pool after calling end").
• Adopts the OpenNext Custom Worker pattern (worker-cf.ts) as the wrangler entry; deletes the obsolete postbuild patch script.
• Pins requestDbStore AsyncLocalStorage to globalThis via Symbol.for(...) so the wrangler/esbuild bundle and the Next.js/webpack bundle share one instance.
• Adds a wrangler alias for server-only to a no-op shim so the Workers bundle doesn't crash at startup on the package's throwing default export.
• Disables sign-up on the Cloudflare deploy target (UI + Better-auth endpoint); self-host stays open.
• Promotes the wrangler config to explicit env.production isolation so an accidental wrangler deploy without --env fails fast instead of misbinding production resources.
• Hardens the deploy guard: requires env.production to exist, no placeholder IDs, and exact-name match against all five required production secrets via parsed JSON output.
• Enables Workers observability (logs + traces, persisted) for production.
• Updates four MCP plugin configs to expose both hosted and localhost MCP servers.
• One-line cache-invalidate-on-reconnect fix in RealtimeBridge so events missed during SSE disconnect windows are picked up on the next observed read.

Type of change

• Bug fix
• New feature
• Refactor / cleanup

Testing

• Tested locally with `bun run dev` (self-host smoke pending operator)
• Linting passes (`bun run lint`)
• Typecheck passes (`bun run typecheck`)

Production verified end-to-end on `https://app.mymir.dev\` via Chrome DevTools: sign-in, dashboard, project view, task detail panel, MCP OAuth handshake, SSE realtime updates — all working, zero console errors, no "pool ended" lines in `wrangler tail` since the per-isolate refactor.

Notes for reviewer

• The per-isolate pool trades some per-query handshake latency for reliability against streaming responses. Future cost-optimization work (measure first, then choose between `neon-http` adapter, Hyperdrive + `pg`, or a custom streaming-lifecycle hook) is tracked separately as MYMR-211.
• `wrangler.jsonc` contains resource handles (KV id, D1 UUID, R2 bucket name, rate-limit ids). Per Cloudflare conventions these are not credentials — all production secrets live in `wrangler secret put` and `.dev.vars` (gitignored, confirmed never committed via `git log`).
• Workerd emits two warnings at deploy time about the DO classes not being exported. Both are exported via `worker-cf.ts` re-exports and work at runtime (verified live); the warnings are a known workerd static-check limitation that does not follow re-exports across files. Tracked as future cleanup.
• The `middleware.ts` → `proxy.ts` Next.js 16 deprecation warning is blocked upstream — opennextjs-cloudflare hasn't shipped Next 16 Adapter API integration yet (the Adapter API itself was stabilized in Next.js 16.2). We continue to use `middleware.ts` (the OpenNext-accepted name) until that lands.