Provision and rotate production credentials for the Cloudflare site API

Parent: #1970

## Goal

Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.

## Current limitation

Bearer token definitions are static JSON in `WORDPRESS_API_TOKENS`, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.

## Scope

- generic issuer-backed principal identity or service-account API keys stored only as digests
- scoped grants for artifact staging, site create/read/import, operation read, renewal, and deletion
- per-principal quotas, expiration, revocation, rotation overlap, and optional site restrictions
- administrator-claim and persistent site credential root rotation with generation/version evidence
- redacted audit events for authentication, authorization, allocation, claims, and revocation
- Homeboy-managed secret/binding preflight without exposing plaintext values

## Acceptance criteria

- A principal can be issued, rotated, and revoked without Worker source changes or redeployment where the Cloudflare binding model permits.
- Revocation is effective for new API calls while previously committed operations follow explicit policy.
- Scope, quota, expiry, site ownership, and cross-principal denial are deterministic.
- Secret rotation preserves or intentionally invalidates administrator claims and credentials according to versioned policy.
- Logs and deployment evidence contain no bearer, claim, password, or derived secret values.
- Local and isolated remote gates cover malformed tokens, replay, rotation overlap, revocation races, and least privilege.
- Production mutation remains a separately authorized operator step.

## AI assistance

OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.

Inizia esaminando il JSON statico in WORDPRESS_API_TOKENS e il contratto di autenticazione unificato della provisioning API, quindi ispeziona il binding di Cloudflare e il preflight dei secret gestito da Homeboy. Usa i gate locali e remoti isolati per token malformati, replay, sovrapposizione delle rotazioni, race condition durante la revoca e least privilege. Il lavoro è completato quando i criteri di accettazione sono soddisfatti senza esporre i valori dei secret, mentre le mutazioni in produzione restano autorizzate separatamente.

Scritto dal modello di indicizzazione a partire dal testo della issue.