Harden hosted staging import flow

[dills122]

Summary

• Hardens the hosted staging path after real Cloudflare/GitHub App testing.
• Fixes GitHub OAuth PKCE verifier length for deployed auth.
• Improves starred import recovery when a page request stalls.

What Changed

• Added a valid 43-128 character PKCE verifier and updated Worker auth coverage.
• Added per-page import request timeout handling with one retry and cleanup for timers/listeners.
• Wired staging/production Worker config to the real Cloudflare custom domains and KV bindings.
• Updated OpenTofu to manage Pages DNS records and align Worker custom-domain attachment with Wrangler environment service behavior.
• Made hosted smoke checks staging-aware with FORAGE_SMOKE_EXPECT_PRODUCTION=false.
• Added IndexedDB migration hardening coverage for local database schema changes.
• Updated hosting, infrastructure, deployment, and storage docs for the proven setup.

Validation

• npm run check
• FORAGE_WEB_ORIGIN=https://forage-staging.shrimpworks.dev FORAGE_WORKER_ORIGIN=https://api-staging.forage.shrimpworks.dev FORAGE_SMOKE_EXPECT_PRODUCTION=false pnpm smoke:hosted

Scope Notes

• No .env, terraform.tfvars, Terraform state, Wrangler state, or build output is included.
• Cloudflare KV namespace IDs and project hostnames are deployment config, not secrets.
• Branch includes two commits: local DB migration hardening and hosted staging/import hardening.