Add manual Cloudflare deployment workflow

[dills122]

Summary

• Adds a manual GitHub Actions deployment workflow for Cloudflare Worker and Pages deploys.
• Wires OpenTofu formatting into the main CI contract.
• Documents required deployment secrets, environment variables, and first-deploy sequencing.

What Changed

• Added .github/workflows/deploy.yml with staging/production workflow dispatch inputs.
• Added OpenTofu setup and npm run infra:fmt:check to .github/workflows/check.yml.
• Added infra:fmt:check to the root npm run check.
• Added docs/23-deployment-automation.md.
• Updated hosting, infrastructure, CI, and docs index references.

Validation

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/check.yml"); YAML.load_file(".github/workflows/deploy.yml"); puts "workflow yaml ok"'
• npm run check:docs
• npm run check:workspace
• npm run infra:fmt:check
• npm run check

Scope Notes

• Workflow is manual-only for now so hosted deploys stay operator-controlled.
• GitHub App client secrets remain Cloudflare Worker secrets, not public GitHub variables.
• Hosted smoke checks are optional until real Cloudflare domains are configured.