Deferred: destroy Fly app kcd + leftover DNS/token cleanup

## Context

Production runs on Cloudflare Workers. Keep Fly app `kcd` (and its volume) alive for a couple of weeks as a safety net, then destroy it. Do **not** destroy until Kent confirms the window is closed.

## Destructive action warning

Destroying the Fly app or its volume is irreversible. Re-confirm immediately before destroying.

## Acceptance criteria

- [ ] Get explicit confirmation from Kent that the keep-alive window is closed.
- [ ] Optional: final D1-vs-Fly reconciliation across app tables if desired before destroy.
- Fly machine `080750ec6d0098` (dfw), SQLite path `/data/litefs-disabled/sqlite.db`
- Production D1 `kentcdodds-com-db` (`af33bd8b-c9b2-484a-afa5-43ee322ff49c`)
- `Password` keys on `userId`, not `id`
- [ ] Destroy Fly app `kcd` and its `data_machines` volume.
- [ ] Remove leftover Fly DNS:
- `_acme-challenge.kentcdodds.com` CNAME → `kentcdodds.com.xz2p1k.flydns.net`
- `_fly-ownership.kentcdodds.com` TXT
- [ ] Revoke the temporary Cloudflare API token from private cutover cleanup notes.
- [ ] Delete local Fly snapshot files (may contain PII), including any `migrate-snapshot-*.db`.
- [ ] Verify production health: `/healthcheck` 200 and `/__meta` responds.

Start by confirming with Kent that the keep-alive window is closed; do not destroy anything before that confirmation. Review the Fly app `kcd`, its `data_machines` volume, the listed DNS records, the temporary Cloudflare token, and local `migrate-snapshot-*.db` files. Done means the app and volume are destroyed, leftovers and snapshots are removed, the token is revoked, and `/healthcheck` returns 200 while `/__meta` responds.

Written by the indexing model from the issue text.