perf: build the custom Workers entrypoint that #507 and #541 both require

[tiankaima]

Problem

#507 (anonymous SSR edge caching gateway) and #541 (selective Workers Caching for catalog APIs) are currently blocked on the same prerequisite: the app runs on the default @sveltejs/adapter-cloudflare entrypoint (wrangler.jsonc main: .svelte-kit/cloudflare/_worker.js), so there is no place to implement gateway routing or caches.default usage.

Scope of the prerequisite

• Custom worker entry (wrangler.jsonc main → checked-in file re-exporting the adapter server) with named entrypoints.
• compatibility_date bump to >= 2026-07-19 plus global_fetch_strictly_public and cache.enabled (required by the perf(api): isolate catalog APIs behind selective Workers Caching #541 probe).
• Routing shim: anonymous/no-auth-signal requests (hasRequestAuthSignal already exists in src/lib/auth/request-auth-signal.ts) and explicit-locale catalog GET/HEAD (resolvePublicCatalogLocale, src/lib/api/routes/request-locale.ts:30-53) go to the cached path; everything else passes through.
• CSP strategy for cached anonymous HTML: the per-request nonce (src/lib/security/csp.ts:26-30, injected in hooks.server.ts:164,187-193) and x-request-id currently make raw HTML uncacheable — cached documents need a nonce-free (or hash-based) CSP variant on the anonymous path only.
• Cache key must use the normalized negotiated locale (negotiateLocale), never raw Cookie/Accept-Language (i18n/seo: keep locale out of paths while defining cache and indexing behavior #551 constraint); HTML currently emits no Vary.
• Double-cache audit: isolate cache (src/lib/public-runtime-cache.ts) + Workers Cache + outer zone CDN (Cloudflare-CDN-Cache-Control from perf(api): split browser and Cloudflare catalog cache policy #539) must not stack contradictory TTLs.

Refs #507
Refs #541
Refs #551