Preserve Cloudflare Access configuration across deploys

[davidwrossiter]

Fixes #1494.

By default, Wrangler replaces a Worker's live variables with the vars declared in each deployment. The repository placeholders could therefore replace an installation's real Access domain, audience and administrator list. Wrangler still reported success, but the Worker then rejected every request.

• Enable keep_vars and remove installation-specific Access values from wrangler.jsonc.
• Keep ENABLE_DEV_AUTH explicitly false so a stale remote override cannot survive a production deploy.
• Fail closed with an actionable 503 response until ACCESS_TEAM_DOMAIN and ACCESS_AUD are set. Keep authentication failures at 401.
• Update the setup guidance and add regression coverage for runtime and Wrangler configuration.

Validation:

• bun run format:check
• bun run lint
• bun run typecheck (42/42 tasks)
• bun run test (36/36 tasks)
• bun run build in apps/host-cloudflare
• bunx wrangler deploy --dry-run with normal and bootstrap variables