fix: improve Worker previews and upstream API requests

[imconnorngl]

Description

Worker API requests forwarded browser cookies and Cloudflare Access JWT headers to the SkyCrypt backend, which can exceed its request-header limit. The API client now forwards only the enabledPacks preference cookie from incoming requests, preserves explicitly configured API headers, sets the server API token and Lunar Client User-Agent, and disables automatic credential forwarding.

Upstream challenge pages and invalid responses now produce diagnostic HTTP errors at the API boundary. Worker deployments run before branch preview uploads so the Worker exists and its observability settings are applied.

Type of Change

• Bug fix
• Build/CI changes

Changes Made

• Filter incoming API-request headers while preserving resource-pack preferences and server authentication.
• Detect confirmed Cloudflare challenges, unexpected response types, malformed JSON, and unsuccessful API responses.
• Include the endpoint, upstream HTTP status, content type, and Cloudflare Ray ID in errors, omitting URL credentials, query strings, and raw response bodies.
• Preserve successful JSON response envelopes, backend error messages/statuses, and PNG image endpoints.
• Deploy through cloudflare/wrangler-action@v3, then upload aliased and tagged previews for non-dev branches.

Testing

• pnpm test --project server: 318 tests passed across 13 files.
• pnpm check: zero errors and warnings.
• ESLint and oxfmt checks for the changed files passed.
• git diff --check passed.
• pnpm lint stops on an existing formatting issue in unchanged CLAUDE.md.

Deployment Notes

dev uses cloudflare-production; other branches use cloudflare-development. Each GitHub environment must supply CLOUDFLARE_ENV, CLOUDFLARE_API_TOKEN, and CLOUDFLARE_ACCOUNT_ID.