ci: manage worker secrets via wrangler-action in deploy

Push GITHUB_CLIENT_ID/SECRET, GOOGLE_CLIENT_ID/SECRET and JWT_SECRET to
the Worker on each deploy, sourced from repo Actions secrets. GITHUB_*
worker secrets map from GH_OAUTH_* actions secrets (GITHUB_ prefix is
reserved). SENTRY_DSN stays manually managed on Cloudflare.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: fullstackjam

.github/workflows/deploy.yml

@@ -40,6 +40,18 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          secrets: |
+            GITHUB_CLIENT_ID
+            GITHUB_CLIENT_SECRET
+            GOOGLE_CLIENT_ID
+            GOOGLE_CLIENT_SECRET
+            JWT_SECRET
+        env:
+          GITHUB_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+          GITHUB_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+          JWT_SECRET: ${{ secrets.JWT_SECRET }}
 
       - name: Health Check
         run: |