feat(cloudflare): add linearvoid-media edge worker for R2 HLS delivery

Replace the ad-hoc `worker.js` with a self-contained `linearvoid-media`
worker under `infrastructure/cloudflare/` that owns `media.linearvoid.tv`.
It serves HLS objects from the R2 bucket, enforcing immutable Cache-Control
on segments, a short TTL on live manifests, plus HLS CORS, OPTIONS
preflight, Range support, and a `/health` probe. Includes wrapper config
with production domain, Vitest unit tests, Miniflare R2 integration tests,
automated deploy workflow, and docs updates.

infrastructure/cloudflare/wrangler.toml

@@ -0,0 +1,25 @@
+# Cloudflare Worker: linearvoid-media (edge HLS delivery)
+# Serves HLS objects from the `linearvoid-media` R2 bucket on media.linearvoid.tv.
+# Applies immutable caching to media segments and a short TTL to live manifests.
+# This worker replaces direct R2 custom-domain serving on the media host so cache
+# headers/CORS are controlled in code (cache rules remain as the origin baseline).
+
+name = "linearvoid-media"
+main = "src/worker.js"
+compatibility_date = "2025-08-01"
+
+# R2 bucket holding the HLS objects. The request path is mirrored onto the bucket,
+# e.g. GET /hls/playlist.m3u8 -> object key `hls/playlist.m3u8`.
+[[r2_buckets]]
+binding = "MEDIA_BUCKET"
+bucket_name = "linearvoid-media"
+
+# Default environment: deploy to the preview *.workers.dev URL (test target).
+#   npx wrangler deploy
+#
+# Production environment: attach the media host as a custom domain on this worker.
+#   npx wrangler deploy --env production
+[env.production]
+routes = [
+  { pattern = "media.linearvoid.tv", custom_domain = true }
+]