feat(infra): provision R2 through trusted Workers Builds

[EagleFox31]

Moves the reusable private-media R2 path onto Cloudflare Workers Builds instead of requiring the AppFactory runtime secret to call the R2 REST API directly.

Why:

• Commerce Factory proved the current AppFactory runtime tokens return Cloudflare 10000 Authentication error on the R2 control endpoint even though the account already has an R2-capable token registered with Workers Builds.
• the existing registered appfactory-api build token already has R2 access and Cloudflare Builds can use it without revealing or rotating its secret.

What changes:

• brownfield Worker requests may declare the reviewed r2: { "recipe": "private-media" } capability;
• AppFactory derives the deterministic <repo>-media bucket name;
• AppFactory selects a trusted registered R2-capable Workers Builds token by infrastructure-controlled name;
• Wrangler checks/creates the bucket idempotently before Worker deploy;
• R2-enabled provisioning waits for the build and returns bucket/build evidence;
• no new token value, rotation or secret copy is required.

The direct /infrastructure/r2 endpoint remains available for environments where a runtime R2 credential is configured.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	appfactory-api	b0aebde	Commit Preview URL Branch Preview URL	Oct 09 2026, 11:50 AM