feat(engine): merge cloudflare-migration — paradigm D engine, BYOK proxy, story persistence (#95)

Squash-merge the cloudflare-migration branch (7 commits by Kai ki) into
staging with conflict resolution, feature integration, and bug fixes.

Engine:
- Paradigm D: single-stream Writer replacing dual-phase Plan/Beats
- Delete Architect agent; story bible generated via Writer <plan> tag
- Modular prompt architecture (segments/registry/builder)
- StreamRouter for tagged stream splitting (<plan>/<story>/<choices>)

Infrastructure:
- Cloudflare Workers deployment (wrangler.jsonc, OpenNext adapter)
- D1 database schema + Drizzle ORM (scaffolded, not yet active)
- R2 storage helpers (scaffolded, not yet active)
- Story persistence API routes + client-side persistence

BYOK (Bring Your Own Key):
- /api/llm/user-proxy with SSRF-protected LLM proxy (+ requireUser auth)
- CORS-aware fetch in ai-client: auto-detect CORS failure, fallback to
  server proxy transparently via OpenAI SDK custom fetch
- BYO config support added to classify-freeform and vision routes
- SettingsModal CORS privacy notice (keys never logged/stored)

SSE streaming:
- engineClient.ts: fetchSSE helper for progressive scene events
- startSession/requestScene accept optional emit callback
- Fix SSE error event field name (error → message) in scene/start routes

i18n integration:
- Wire buildLanguageDirective into paradigm D's prompt builder
- Update corsNotice i18n keys (zh-CN/en/ja) with CORS proxy privacy text
- Preserve Session.language + LanguageSwitcher from i18n commit

Co-authored-by: Kai ki <155355644+zbf1009@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

app/api/start/route.ts

@@ -1,9 +1,13 @@
 import { startSession } from "@infiplot/engine";
-import type { StartRequest } from "@infiplot/types";
+import type { SceneStreamEvent, StartRequest } from "@infiplot/types";
 import { NextResponse } from "next/server";
 import { loadEngineConfig } from "@/lib/config";
 import { requireUser } from "@/lib/supabase/guard";
 
+function formatSSE(event: SceneStreamEvent | { type: string; [k: string]: unknown }): string {
+  return `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`;
+}
+
 export const runtime = "nodejs";
 
 // Matches /api/vision and /api/parse-style-image — the user's resized 512px
@@ -43,14 +47,47 @@ export async function POST(req: Request) {
     }
   }
 
+  const acceptsSSE = req.headers.get("accept")?.includes("text/event-stream");
+
   try {
     const base = loadEngineConfig();
-    // BYO key: the browser provisions + synths voices directly against Xiaomi
-    // (key never reaches us), so strip server-side TTS so the engine skips all
-    // provisioning + synth. See StartRequest.clientTts.
     const config = body.clientTts === true ? { ...base, tts: undefined } : base;
-    const result = await startSession(config, body);
-    return NextResponse.json(result);
+
+    if (!acceptsSSE) {
+      const result = await startSession(config, body);
+      return NextResponse.json(result);
+    }
+
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+      async start(controller) {
+        try {
+          const result = await startSession(config, body, (event) => {
+            controller.enqueue(encoder.encode(formatSSE(event)));
+          });
+          controller.enqueue(
+            encoder.encode(
+              formatSSE({ type: "done", response: result }),
+            ),
+          );
+          controller.close();
+        } catch (err) {
+          const message = err instanceof Error ? err.message : "Unknown error";
+          controller.enqueue(
+            encoder.encode(formatSSE({ type: "error", message })),
+          );
+          controller.close();
+        }
+      },
+    });
+
+    return new Response(stream, {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+      },
+    });
   } catch (err) {
     const message = err instanceof Error ? err.message : "Unknown error";
     return NextResponse.json({ error: message }, { status: 500 });