feat(engine): merge cloudflare-migration — paradigm D engine, BYOK proxy, story persistence (#95)

Squash-merge the cloudflare-migration branch (7 commits by Kai ki) into
staging with conflict resolution, feature integration, and bug fixes.

Engine:
- Paradigm D: single-stream Writer replacing dual-phase Plan/Beats
- Delete Architect agent; story bible generated via Writer <plan> tag
- Modular prompt architecture (segments/registry/builder)
- StreamRouter for tagged stream splitting (<plan>/<story>/<choices>)

Infrastructure:
- Cloudflare Workers deployment (wrangler.jsonc, OpenNext adapter)
- D1 database schema + Drizzle ORM (scaffolded, not yet active)
- R2 storage helpers (scaffolded, not yet active)
- Story persistence API routes + client-side persistence

BYOK (Bring Your Own Key):
- /api/llm/user-proxy with SSRF-protected LLM proxy (+ requireUser auth)
- CORS-aware fetch in ai-client: auto-detect CORS failure, fallback to
  server proxy transparently via OpenAI SDK custom fetch
- BYO config support added to classify-freeform and vision routes
- SettingsModal CORS privacy notice (keys never logged/stored)

SSE streaming:
- engineClient.ts: fetchSSE helper for progressive scene events
- startSession/requestScene accept optional emit callback
- Fix SSE error event field name (error → message) in scene/start routes

i18n integration:
- Wire buildLanguageDirective into paradigm D's prompt builder
- Update corsNotice i18n keys (zh-CN/en/ja) with CORS proxy privacy text
- Preserve Session.language + LanguageSwitcher from i18n commit

Co-authored-by: Kai ki <155355644+zbf1009@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

lib/db/client.ts

@@ -0,0 +1,41 @@
+import "server-only";
+
+import { drizzle } from "drizzle-orm/d1";
+import { getCloudflareContext } from "@opennextjs/cloudflare";
+import * as schema from "./schema";
+
+/**
+ * Get D1 database instance from Cloudflare Workers env binding.
+ *
+ * Usage in API routes:
+ *   const db = getDb();
+ *   const stories = await db.select().from(schema.stories).where(...);
+ *
+ * @throws Error if called outside Cloudflare Workers runtime (e.g. local dev without wrangler)
+ */
+export function getDb() {
+  try {
+    const { env } = getCloudflareContext();
+
+    if (!env.DB) {
+      throw new Error(
+        "D1 binding 'DB' not found. " +
+        "Ensure wrangler.jsonc has d1_databases configured and you're running via wrangler dev/deploy."
+      );
+    }
+
+    return drizzle(env.DB, { schema });
+  } catch (error) {
+    // Re-throw with more context for debugging
+    throw new Error(
+      `Failed to get D1 database: ${error instanceof Error ? error.message : String(error)}. ` +
+      "Make sure you're running in Cloudflare Workers context (wrangler dev/deploy)."
+    );
+  }
+}
+
+/**
+ * Type alias for the Drizzle D1 database instance.
+ * Useful for dependency injection and testing.
+ */
+export type DbInstance = ReturnType<typeof getDb>;