Provision and rotate production credentials for the Cloudflare site API

Parent: #1970

## Goal

Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.

## Current limitation

Bearer token definitions are static JSON in `WORDPRESS_API_TOKENS`, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.

## Scope

- generic issuer-backed principal identity or service-account API keys stored only as digests
- scoped grants for artifact staging, site create/read/import, operation read, renewal, and deletion
- per-principal quotas, expiration, revocation, rotation overlap, and optional site restrictions
- administrator-claim and persistent site credential root rotation with generation/version evidence
- redacted audit events for authentication, authorization, allocation, claims, and revocation
- Homeboy-managed secret/binding preflight without exposing plaintext values

## Acceptance criteria

- A principal can be issued, rotated, and revoked without Worker source changes or redeployment where the Cloudflare binding model permits.
- Revocation is effective for new API calls while previously committed operations follow explicit policy.
- Scope, quota, expiry, site ownership, and cross-principal denial are deterministic.
- Secret rotation preserves or intentionally invalidates administrator claims and credentials according to versioned policy.
- Logs and deployment evidence contain no bearer, claim, password, or derived secret values.
- Local and isolated remote gates cover malformed tokens, replay, rotation overlap, revocation races, and least privilege.
- Production mutation remains a separately authorized operator step.

## AI assistance

OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.

Start by reviewing the static JSON in WORDPRESS_API_TOKENS and the merged provisioning API authentication contract, then inspect the Cloudflare binding and Homeboy-managed secret preflight. Use the local and isolated remote gates for malformed tokens, replay, rotation overlap, revocation races, and least privilege. Done means the acceptance criteria are met without exposing secret values, with production mutation remaining separately authorized.

Written by the indexing model from the issue text.