ci: test pipeline and continuous deploy to Cloudflare

[TOMOKI977]

Summary

Links deploys to this repository. After this PR, every merge to main goes live on Cloudflare automatically, and every PR runs the tests.

• verify job (every PR and every push to main): npm ci, typecheck, test.
• deploy job (push to main only, after verify passes): applies the D1 migrations with --remote, then runs wrangler deploy.
• wrangler.jsonc: the single DB binding now points at the real D1 database, and BOT_INFO is set as a var (the public getMe result).

Review first: .github/workflows/ci.yml, in particular the order of the deploy steps.

Decisions

Topic	Decision
Deploy mechanism	GitHub Actions rather than Workers Builds, so the pipeline is versioned and reviewed like code
Order	Migrations run before the new Worker, so code never queries a missing schema. Migrations must stay backward compatible with the Worker that is still running
Concurrency	Only one production deploy at a time. A newer push waits for the running one instead of cancelling it
Supply chain	Actions pinned by commit SHA (checkout v7.0.1, setup-node v7.0.0). wrangler comes from package-lock.json
Permissions	contents: read only
Secrets	GitHub holds only CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID. The runtime secrets (BOT_TOKEN, WEBHOOK_SECRET, PII_KEYRING) are set once with wrangler secret put and never pass through GitHub

wrangler d1 create had added a second binding (hack_bot_db) with "remote": true. It was removed: the code uses env.DB, and remote would have pointed local development at the production database.

Test plan

• npm test: 144/144 tests pass locally with the new config
• npm run typecheck: clean
• The CI verify job passes on this PR
• After merge: the deploy job applies the migrations and publishes the Worker