WI-007: Deploy the docs subsite to Cloudflare Pages

Problem

WI-004 (#5) built the subsite but could not deploy it — that needed Cloudflare credentials from WI-H04 (#12). Rather than block the whole subsite on an account signup, or quietly drop the DoD line, the deploy was split here.

In scope

Cloudflare Pages project, created from CI rather than the dashboard.
Deploy on merge to main; preview deployment per PR, with the URL commented on the PR.
The live URL recorded in the README, replacing WI-004’s placeholder.

Out of scope

Custom domain — *.pages.dev is sufficient at this stage.
Access control. The subsite is public; the repository is not (ADR-0018).
Deploying anything other than the docs. apps/web and apps/api deploy under their own work items.

Definition of done

Pages project tabletop-tracker-docs exists and the workflow can deploy to it.
Merging to main publishes; the live URL returns 200.
A PR touching docs/ produces a preview deployment with its own URL, commented on the PR.
The README records the live URL, with no placeholder left.
A docs-only change reaches the live site — end-to-end, not just a green workflow.

Verification

curl -s -o /dev/null -w '%{http_code}\n' https://tabletop-tracker-docs.pages.dev/
curl -s -o /dev/null -w '%{http_code}\n' https://tabletop-tracker-docs.pages.dev/decisions/adr-0013-docs-subsite-starlight/

Then confirm a string added to a doc appears on the live site after merge.

Notes

Direct upload with wrangler, not Cloudflare’s Git integration. The Git integration is configured through the dashboard behind an OAuth grant — an agent cannot set it up, and it puts deploy configuration outside version control. Direct upload works from the API token alone and keeps the config reviewable.

The project-create step is deliberately tolerant of “already exists”: failing there would break every deploy after the first.