feat(engine): merge cloudflare-migration — paradigm D engine, BYOK proxy, story persistence (#95)

Squash-merge the cloudflare-migration branch (7 commits by Kai ki) into
staging with conflict resolution, feature integration, and bug fixes.

Engine:
- Paradigm D: single-stream Writer replacing dual-phase Plan/Beats
- Delete Architect agent; story bible generated via Writer <plan> tag
- Modular prompt architecture (segments/registry/builder)
- StreamRouter for tagged stream splitting (<plan>/<story>/<choices>)

Infrastructure:
- Cloudflare Workers deployment (wrangler.jsonc, OpenNext adapter)
- D1 database schema + Drizzle ORM (scaffolded, not yet active)
- R2 storage helpers (scaffolded, not yet active)
- Story persistence API routes + client-side persistence

BYOK (Bring Your Own Key):
- /api/llm/user-proxy with SSRF-protected LLM proxy (+ requireUser auth)
- CORS-aware fetch in ai-client: auto-detect CORS failure, fallback to
  server proxy transparently via OpenAI SDK custom fetch
- BYO config support added to classify-freeform and vision routes
- SettingsModal CORS privacy notice (keys never logged/stored)

SSE streaming:
- engineClient.ts: fetchSSE helper for progressive scene events
- startSession/requestScene accept optional emit callback
- Fix SSE error event field name (error → message) in scene/start routes

i18n integration:
- Wire buildLanguageDirective into paradigm D's prompt builder
- Update corsNotice i18n keys (zh-CN/en/ja) with CORS proxy privacy text
- Preserve Session.language + LanguageSwitcher from i18n commit

Co-authored-by: Kai ki <155355644+zbf1009@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

wrangler.jsonc

@@ -11,10 +11,77 @@
   "observability": {
     "enabled": true
   },
-  // 60s mirrors vercel.json maxDuration for the scene pipeline tail
-  // (multi-agent LLM, ~30-45s p95). Requires Workers Paid — Free is capped
-  // at 10ms CPU. I/O wait does not count against this budget.
-  "limits": {
-    "cpu_ms": 60000
-  }
+  // Placement Hint: pin Worker execution near Azure East Asia (Hong Kong),
+  // the lowest-latency Cloudflare region for mainland China users. Provides a
+  // stable, China-adjacent execution location for SSR + API routes.
+  // Note: static assets always serve from the edge nearest the user regardless.
+  "placement": {
+    "region": "azure:eastasia"
+  },
+  // CPU time limit: Workers Paid plan default is 30s, which is sufficient.
+  // InfiPlot scene pipeline is I/O-bound (5-6 LLM API calls with 3-15s each),
+  // actual CPU work (JSON parse, string ops) ~200ms. No cpu_ms override needed.
+  // Previous 60000ms was a Vercel maxDuration (wall-time) to Cloudflare cpu_ms
+  // (pure CPU) misconfiguration — those are fundamentally different metrics.
+  // "limits": {
+  //   "cpu_ms": 30000
+  // },
+
+  // ── Cloudflare D1 database ───────────────────────────────────────────
+  // User stories persistence (REQ-4) + featured stories metadata (REQ-5).
+  // Create via: wrangler d1 create infiplot-db
+  // Then paste the returned database_id below.
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "infiplot-db",
+      "database_id": "79921d13-1066-443b-8bc4-c6bb09bc1392"
+    }
+  ],
+
+  // ── Cloudflare R2 bucket ─────────────────────────────────────────────
+  // User-generated scene images / portraits (REQ-4, REQ-6 optional).
+  // Create via: wrangler r2 bucket create infiplot-assets
+  // Phase 1: R2 code exists but not called — safe to skip R2 setup for now.
+  "r2_buckets": [
+    {
+      "binding": "R2_BUCKET",
+      "bucket_name": "infiplot-assets"
+    }
+  ],
+
+  // ── Non-sensitive runtime configuration ──────────────────────────────
+  // Base URLs, model names, and feature flags (no API keys).
+  // Committed to git for team-wide consistency. API keys go in Secrets below.
+  "vars": {
+    "NEXT_PRIVATE_MINIMAL_MODE": "1",
+    "TEXT_BASE_URL": "https://api.openai-next.com/v1",
+    "TEXT_MODEL": "gemini-3.1-flash-lite-preview",
+    "IMAGE_BASE_URL": "https://api.runware.ai/v1",
+    "IMAGE_MODEL": "runware:400@6",
+    "VISION_BASE_URL": "https://token-plan-sgp.xiaomimimo.com/v1",
+    "VISION_MODEL": "mimo-v2.5",
+    "TTS_BASE_URL": "https://token-plan-sgp.xiaomimimo.com/v1",
+    "TTS_SPEECH_MODEL": "mimo-v2.5-tts",
+    "MOCK_IMAGE": "false"
+  },
+
+  // ── Secrets (set via Dashboard or `wrangler secret put`) ─────────────
+  // After first deploy: Dashboard → Settings → Variables → Add Secret (encrypt)
+  // Required (3):  TEXT_API_KEY, IMAGE_API_KEY, VISION_API_KEY
+  // Optional (2):  TTS_API_KEY (配音), GALLERY_SECRET (分享文件加密)
+  //
+  // See DEPLOYMENT-SECRETS.md for detailed setup instructions.
+  // Never commit real keys to git; they belong in encrypted Secrets only.
+  // ────────────────────────────────────────────────────────────────────
+
+  // ── Cloudflare KV namespace ──────────────────────────────────────────
+  // Reserved for future caching / rate limiting. Not used in Phase 1.
+  // Create via: wrangler kv namespace create KV
+  "kv_namespaces": [
+    {
+      "binding": "KV",
+      "id": "c952d810a8a942faa507042b87845ce9"
+    }
+  ]
 }