Add Cloudflare Workers observability to Cloudflare gatekeeper

[ndisidore]

Adds account- and Worker-scoped observability sessions with listKeys() and listValues() for discovery, listEvents(), listInvocations(), listTraces(), and getTrace() for telemetry inspection, and calculate() for aggregate metrics.

[ask-bonk]

I have completed a thorough review. The four findings raised in the earlier ask-bonk comment were all addressed in the second commit ("Fix Cloudflare gatekeeper build tasks"): build:configurator is now the shared Vite+ task via vite.config.ts re-exporting withTests, build/deploy call the builder directly, the test script is test:run, and clean removes src/generated. The wiring now matches gatekeeper-github exactly.

I reviewed the current implementation for new defects and found none actionable. No inline review submitted.

LGTM!

Summary of what I verified:

• Worker-scoping / security: immutable $metadata.service server-side filter plus defensive post-filtering in listEvents/listInvocations/getTrace; listTraces rejected for Worker bindings; foreign-event tests confirm no cross-service leakage (including via cursors and serialized output).
• Observation authorization: #observe fetches then calls authorizeObservation before returning — exactly the documented read-only ordering (gatekeeper.ts:859-862).
• Observer verification: strategy-B hasObservabilityAccess uses the observer's own credentials via the same-vendor verifier handoff; the as unknown as Fetcher<CloudflareVerifierApi> cast is the documented pattern.
• Guards: SSRF-safe fixed API base, response-size cap (header + streaming), timeframe/retention/limit validation before fetch, bounded body-safe error messages (upstream HTML/secrets not leaked), bounded retry with retry-after, filter depth/node caps.
• Scope handling: server.ts sign-in now sends {scopes:"full", resourceUrlPatterns:[]} → persistentScopesForResources([]) = billing scopes only, so observability isn't requested at sign-in; frontend connectAccount('cloudflare', []) preserves billing-only. README and comments updated consistently.
• Migration: new v1 migration for CloudflareObservabilityGatekeeper added and reflected in the golden manifest.
• Types/tests: types.d.ts public members are documented; the test suite covers scoping, pagination/truncation, error mapping, retries, and calculation series behavior.

One non-blocking note (not a defect): the Worker-scoped getTrace/listEvents truncated/nextCursor are derived from raw provider counts vs. post-filtered events, which is correct today given the server-side service filter and only matters if that filter were ever removed — the code and tests already account for this.

github run