docs: add cloudflare pages, cache rules docs and fix relative links

docs/SETUP.md

@@ -223,7 +223,7 @@ flowchart LR
    - Use Cloudflare proxied DNS with Full (strict) TLS so browser traffic uses `https://linearvoid.tv`, `wss://linearvoid.tv/ws`, and `https://media.linearvoid.tv`.
 
 6. **Apply cache behavior**:
-   - Configure the `.m4s` and `.m3u8` cache rules from `infrastructure/cloudflare/cache-rules.md`.
+   - Configure the `.m4s` and `.m3u8` cache rules from [cache-rules](../docs/infrastructure/cloudflare/cache-rules.md).
    - Enable Smart Tiered Cache for the R2-backed hostname.
    - If you need header normalization for immutable segment caching, deploy `infrastructure/cloudflare/worker.js` to the same zone.
 
@@ -272,7 +272,7 @@ Configure Cloudflare Cache Rules:
 4. Validate behavior using response headers:
    - `Cf-Cache-Status` should move from `MISS` to `HIT` for hot objects
 
-Reference: `infrastructure/cloudflare/cache-rules.md`.
+Reference: [cache-rules](../docs/infrastructure/cloudflare/cache-rules.md).
 
 ### 4. Cloudflare Pages
 
@@ -557,7 +557,7 @@ To allow the Gitea Actions runner (or your local machine) to deploy to the remot
 1. **Provision VPS**: Use Hetzner Cloud CX22 in Ashburn, VA (per ADR-001).
 2. **Configure Cloudflare**:
    - Create R2 bucket with `enam` location hint.
-   - Set up custom media domain (`media.linearvoid.tv`) with the cache rules from `infrastructure/cloudflare/cache-rules.md`.
+   - Set up custom media domain (`media.linearvoid.tv`) with the cache rules from [cache-rules](../docs/infrastructure/cloudflare/cache-rules.md).
    - Point `linearvoid.tv` and `www.linearvoid.tv` at the app entrypoint, then redirect `www` to the apex domain.
    - Use Full (strict) TLS for both app and media hostnames.
    - Apply the Worker from `infrastructure/cloudflare/worker.js` for advanced header management.