Add CI workflow, admin frontend, Prometheus/Grafana monitoring, Cloudflare cache rules and worker, Nginx config, CONTRIBUTING.md and update docker-compose.yml

infrastructure/cloudflare/cache-rules.md

@@ -0,0 +1,25 @@
+# Cloudflare Cache Rules for Linear Void (per ADR-001)
+
+## Recommended Cache Rules for media.example.com
+
+1. **.ts segments (immutable)**
+   - Expression: (http.host eq "media.example.com" and http.request.uri.path contains ".ts")
+   - Cache status: Eligible for cache
+   - Edge Cache TTL: 1 month (or `Cache-Control: public, max-age=31536000, immutable` from origin)
+   - Cache Everything: Yes
+
+2. **.m3u8 manifests (live)**
+   - Expression: (http.host eq "media.example.com" and http.request.uri.path contains ".m3u8")
+   - Cache status: Eligible for cache
+   - Edge Cache TTL: 10 seconds
+   - Cache-Control: public, max-age=10, must-revalidate
+
+3. **Static assets**
+   - Expression: (http.host eq "example.com" and http.request.uri.path contains ".js" or http.request.uri.path contains ".css")
+   - Edge Cache TTL: 1 year (with hash in filename for immutable caching)
+
+**Tiered Cache**: Enable Smart Tiered Cache for R2 custom domain to reduce origin requests.
+
+**WAF**: Enable basic rate limiting and bot management for /ws and admin routes.
+
+These rules ensure high cache hit ratio for .ts segments while keeping live manifests fresh. Monitor cache hit ratio in Cloudflare analytics.