Reference auth-proxy worker (examples/)

Part of #66

## Problem

~80% of a real BYO integration is the same glue: an edge worker that hides the engine's API key, reads/mints the visitor id, calls the engine, and returns a normalized decision. Every customer rebuilds it.

## Proposal

A **reference auth-proxy worker** under `examples/`:

- a Cloudflare entry + a **framework-neutral core** (portable to other runtimes),
- hides the API key (server-side secret),
- reads/mints the visitor-id cookie,
- calls the engine and returns the **normalized decision** (per the contract sub-issue),
- documented env/secret setup + a minimal engine stub so it runs standalone.

## Acceptance criteria

- [ ] `examples/` worker that runs with documented setup.
- [ ] Key never reaches the client; visitor-id read/mint handled server-side.
- [ ] Emits decisions conforming to the client ⇄ engine contract.
- [ ] README wiring it to the client resolver hook.

Start in examples/ and identify the Cloudflare entry point, framework-neutral core, and minimal engine stub described in the issue. Read the client resolver hook and the client ⇄ engine contract, then follow the README setup. Done means the worker runs standalone, keeps the key server-side, handles the visitor-id cookie, emits normalized decisions, and documents client wiring.

Written by the indexing model from the issue text.