Provision and rotate production credentials for the Cloudflare site API

Parent: #1970

## Goal

Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.

## Current limitation

Bearer token definitions are static JSON in `WORDPRESS_API_TOKENS`, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.

## Scope

- generic issuer-backed principal identity or service-account API keys stored only as digests
- scoped grants for artifact staging, site create/read/import, operation read, renewal, and deletion
- per-principal quotas, expiration, revocation, rotation overlap, and optional site restrictions
- administrator-claim and persistent site credential root rotation with generation/version evidence
- redacted audit events for authentication, authorization, allocation, claims, and revocation
- Homeboy-managed secret/binding preflight without exposing plaintext values

## Acceptance criteria

- A principal can be issued, rotated, and revoked without Worker source changes or redeployment where the Cloudflare binding model permits.
- Revocation is effective for new API calls while previously committed operations follow explicit policy.
- Scope, quota, expiry, site ownership, and cross-principal denial are deterministic.
- Secret rotation preserves or intentionally invalidates administrator claims and credentials according to versioned policy.
- Logs and deployment evidence contain no bearer, claim, password, or derived secret values.
- Local and isolated remote gates cover malformed tokens, replay, rotation overlap, revocation races, and least privilege.
- Production mutation remains a separately authorized operator step.

## AI assistance

OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.

Beginne damit, das statische JSON in WORDPRESS_API_TOKENS und den zusammengeführten Authentifizierungsvertrag der provisioning API zu prüfen, und inspiziere anschließend das Cloudflare-Binding und den von Homeboy verwalteten Secret-Preflight. Verwende die lokalen und isolierten Remote-Gates für fehlerhafte Tokens, Replay, Überschneidungen bei der Rotation, Race Conditions bei der Revocation und Least Privilege. Als erledigt gilt die Aufgabe, wenn die Akzeptanzkriterien erfüllt sind, ohne Secret-Werte offenzulegen, wobei Mutationen in der Produktion weiterhin separat autorisiert bleiben.

Vom Indexierungsmodell aus dem Issue-Text verfasst.