Migrate Cloudflare account (domain + DNS + any Pages/Workers) from personal to org

## Why
The Fallout domain is registered/managed under the maintainer's **personal** Cloudflare account. The domain, DNS, and anything else Cloudflare hosts (Pages, Workers, Tunnels, R2, Email Routing — now including the live `security@fallout.build` route) is one personal-account incident away from the project losing control of its identity. Goal: nothing Fallout-related is *owned by a person*, so the torch can be passed without a scramble.

Registrar is confirmed **Cloudflare Registrar**, so the domain move is an intra-Cloudflare account transfer — no re-registration.

## Ownership model (target)
Cloudflare separates **user** (a login = one email) from **account** (owns zones, billing, members). There is no true service-account *login* for the dashboard; the substitute is a role mailbox as owner + human admins as members.
- **Account owner = a role mailbox** (e.g. `admin@fallout.build`), not a person.
- Maintainer's personal user added as a **Super Administrator member** — full day-to-day access without being the sole owner.
- Passing the torch = handing over the owner-mailbox creds + 2FA seed from the maintainer store. No account surgery needed.
- Automation (DNS/Pages/CI) uses **account-scoped API Tokens**, never a person's global API key.

## Action
- [ ] **Break-glass email account exists — tracked in #523.** It's the account-recovery address here and must land before the recovery step below (see the warning).
- [ ] Create the Cloudflare account under the shared maintainers inbox (depends on #233 for the inbox)
- [ ] Set the account owner to the role mailbox; add ≥2 maintainer users as **Super Administrator** members
- [ ] Inventory the personal account today — domain + DNS zone, Pages (docs site?), Workers, Tunnels, R2 buckets, Email Routing rules (incl. the `security@fallout.build` route)
- [ ] Transfer the domain registration to the org account (Cloudflare Registrar intra-Cloudflare transfer, no re-registration)
- [ ] Move the DNS zone (export + import zone file, or Cloudflare's account-move flow)
- [ ] Recreate any Pages / Workers / Tunnels under the org account
- [ ] Replace personal API credentials with **account-scoped API Tokens**; update GitHub Actions secrets / deploy tokens
- [ ] Lower TTLs ahead of the move; verify DNS continuity (monitor for resolution gaps)
- [ ] Recreate the Email Routing rules (incl. `security@fallout.build`) under the org account
- [ ] Document recovery (2FA backup codes, break-glass email, owner-mailbox creds) in the maintainer-only store

## ⚠️ Recovery must not depend on the zone it manages
The Cloudflare account's login / recovery email must **not** be an address routed through fallout.build's own Email Routing. A locked account or a broken zone would then lock you out of the very inbox needed to recover it — a circular dependency. That is what the **break-glass mailbox** is for: independent MX, separate provider, held in the maintainer store. Keep the CF-routed addresses (`security@`, etc.) for *inbound project mail only*, never for account recovery.

## Coordinate with
- #523 (Break-glass email account) — provides the account-recovery address; blocks the recovery step
- #184 (Register and own a domain) — closed; domain already registered on personal CF, so this issue is the migration
- #233 (Establish org-owned comms accounts) — same shared inbox + recovery-doc store
- #235 (Document and operationalize the fallout.build domain) — the inventory here feeds that doc
- Cloudflare domain verification must be re-done after any GitHub org move

## Done when
- Cloudflare account owned by the role mailbox, with ≥2 maintainer admins
- Break-glass email (#523) done and set as this account's recovery address
- Domain + DNS zone live on the org account; personal account no longer has access
- Pages/Workers/Tunnels recreated under the org, driven by account-scoped API tokens
- Email Routing rules (incl. `security@`) recreated under the org account
- Recovery details (2FA codes, break-glass mailbox, owner creds) documented