MANUAL RUN: Cloudflare protections that need a custom domain for codeSplitters (WAF, bots, auth rate limit, Access, security alert) #722

Left over from #653. These free Cloudflare protections only apply to a domain of your own, and codeSplitters is still on codesplitters.notryanquinn.workers.dev.

First: move codeSplitters to a custom domain (route, BETTER_AUTH_URL, OAuth callbacks). That's its own PR and release.

Then, in the dashboard:

• WAF managed rules on (Security → WAF → Managed rules)
• Bot Fight Mode on. If it blocks MCP clients or the CLI, turn it off and add a WAF custom rule that skips /api/* and /mcp when a bearer token is present.
• Rate-limit rule on /api/auth/*: 20 requests per 10s per IP → block
• Cloudflare Access on /admin* and /api/admin* (one-time PIN to ADMIN_EMAIL, or GitHub login)
• Notification: "Security Events Alert" to email

Check: for i in $(seq 30); do curl -s -o /dev/null -w '%{http_code}\n' https://<site>/api/auth/get-session; done shows a 429 near the end.

Not in scope here, but noted in #653: Turnstile has two codesplitters widgets. When the Turnstile code change is built, keep the one whose secret matches 1Password and delete the other.