Stabilize staging Access redirects and document Cloudflare tokens

[dills122]

Summary

• Adjusts staging Cloudflare Access configuration to avoid redirect/session friction during GitHub OAuth.
• Documents Cloudflare API token permission profiles for local infra, deploy automation, and temporary recovery.
• Keeps staging Access scoped to the canonical custom hostname by default.

What Changed

• Changed staging Access cookie configuration from hardcoded SameSite=Strict to configurable SameSite=Lax.
• Removed staging.forage-web.pages.dev from the default Access app hostname guidance.
• Documented that Pages preview URLs should be protected separately through Cloudflare Pages settings.
• Added docs/24-cloudflare-token-permissions.md with full infra, deploy, and security recovery token profiles.
• Linked the new token-permissions doc from hosting setup, IaC, deployment automation, docs index, and OpenTofu README.

Validation

• tofu plan -refresh=false
• npm run check
• npm run check:docs
• npm run check:workspace
• npm run infra:fmt:check

Scope Notes

• Live Cloudflare apply was not completed because the current TEMP_CLOUDFLARE_API_TOKEN verifies as invalid.
• The targeted OpenTofu plan showed one intended Access app update: remove staging.forage-web.pages.dev and change same_site_cookie_attribute from strict to lax.
• Once a valid token is available, apply with the documented targeted recovery command or a full infra token.