deploy: wire real Cloudflare resources + record live launch

[sovITxyz]

Production launch config for nostrbook.net on the Sovereign IT account.

What

• wrangler.jsonc: real D1 id (e9163b12…), KV id (75a4c5d5…), and the real Turnstile site key (0x4AAAAAAD1JzzXDBykpiavq) replacing the placeholders. No secrets committed — TURNSTILE_SECRET_KEY and ADMIN_PUBKEY are wrangler secrets.
• docs/setup.md: §6 deployment record (resources, DNS, SSL/HSTS, WAF, cron, VPS cutover note).

Live status (Gate A + Gate B complete)

• D1 created + 4 migrations applied --remote; KV created.
• Worker deployed with routes nostrbook.net/* + *.nostrbook.net/*, cron */15.
• DNS cut over: apex A/AAAA → proxied dummies, wildcard CNAME * proxied. SSL Full(strict) + Always-Use-HTTPS + HSTS + TLS1.3.
• Turnstile widget created; blocklist admin enabled (ADMIN_PUBKEY).
• WAF: per-IP throttle (60/10s) + scanner-path block.
• Smoke: 54/54 green vs https://nostrbook.net; 515/515 unit/integration tests on main.

Merge

Two config commits + one docs commit — squash-merge recommended (single clean "launch config" commit on main).