feat(cloud): live settlement evidence, sponsor qualification, and cloud deployment

[kapustazh]

Summary

This PR records the live settlement and policy denial evidence for Gate P4 and sponsor qualification, alongside the Google Cloud Run and Cloudflare Worker cloud deployment bundle.

1. Live Arc Testnet & Privy Drills (Gate P4 Verified)

• Live Settlement Drill:
  • Signed via Privy Server Wallet (eth_signTransaction) and broadcast to Arc Testnet.
  • Tx Hash: 0x72ab1e93c95e5295b2dfa9b3abc8cc5130330f3bba07ad18af2c5b7784f57cf7
  • Block: 61116056
  • Transfer Event: Confirmed at log index 23 (1000000 atomic units / 1.00 USDC transferred to 0xa605EE031E41f04f8e193059a39A24407f83677c).
• Live Policy Denial Drills (Privy):
  • Unauthorized recipient (0x1111...): Privy returned HTTP 400 policy_violation. Broadcasts: 0, settlements: 0.
  • Above-cap amount (2.00 USDC > 1.00 USDC limit): Privy returned HTTP 400 policy_violation. Broadcasts: 0, settlements: 0.
  • Nonce remained 0 during denials, proving zero unauthorized on-chain transactions.
• Crash Recovery & Replay Protection Drill:
  • Simulated worker crash after broadcast (UNKNOWN state).
  • Authoritative read-only reconciliation transitioned intent from UNKNOWN to COMMITTED.
  • Replay request returned 200 REPLAYED with unchanged nonce (0 duplicates), preserving the 1 intent -> at most 1 settlement invariant.

2. Sponsor Qualification Status

• Privy: QUALIFIED (live corporate wallet, normal-path enforcement, zero-settlement policy denials).
• Arc: QUALIFIED (real Arc Testnet USDC transfer, exact Transfer log verified, durable settlement identity).
• The Graph: NOT VERIFIED (fail-closed fallback under FALLBACK_DIRECT_RECOVERY due to unconfirmed decentralized indexer allocation).

3. Cloud Deployment Bundle

• Dockerfile.api: Production container build for Fastify API service on Cloud Run.
• apps/web/worker.ts: Cloudflare Worker reverse-proxying API (/v1/*, /health/*) to Cloud Run and serving static frontend assets.
• wrangler.jsonc: Custom domain routing for oneshot.kapustazh.dev.