feat(api): run apps/api on Cloudflare Workers

[Makisuo]

Summary

Moves apps/api from a Bun HTTP server to a Cloudflare Worker so it can
be deployed independently, without waiting on the in-progress
alchemy-effect infra rewrite on cf-migration.

• Refactors apps/api into a Workers fetch handler (src/worker.ts +
  shared src/app.ts), with DatabaseD1Live using the D1 binding and a
  new EdgeCacheService backed by Workers caches.default (memory
  fallback for tests/Node).
• Splits DatabaseLive into an abstract Database Context.Service with
  two live implementations: DatabaseLibsqlLive (tests, apps/alerting)
  and DatabaseD1Live (worker).
• Wires drizzle D1 migrations natively: wrangler.jsonc sets
  migrations_dir: "../../packages/db/drizzle" and alchemy.run.ts
  passes migrationsDir on the D1Database resource. Drops the one-shot
  SQL bundle approach (couldn't re-run incrementally).
• Adds apps/api/alchemy.run.ts (upstream alchemy package, mirroring
  apps/chat-agent) with stage-based naming and domain mapping, plus
  deploy:stack / destroy:stack scripts.

What this PR does not include

Everything below stays on cf-migration until it's ready:

• .context/alchemy-effect subtree bump
• apps/{web,landing,chat-agent,alerting}/alchemy.run.ts updates
• packages/infra/src/railway rewrite

Notes

• apps/api/src/services/WorkerEnvironment.ts is a local Effect Context
  tag replacing what was originally imported from
  alchemy/Cloudflare/Workers. With customConditions: ["bun"], tsc
  resolves alchemy/* to raw TS source, which fails typecheck against
  the workspace's effect beta version. Keeping a local tag means src/**
  has zero alchemy imports and the deploy-time alchemy.run.ts (outside
  src/**) doesn't pollute the tsc graph.
• First-time deploy steps for the reviewer:
  1. bun install
  2. bun --filter=@maple/api deploy:stack (alchemy provisions D1,
     applies drizzle migrations via migrationsDir, deploys Worker)
  3. Set secrets via env vars before running: TINYBIRD_TOKEN,
     MAPLE_INGEST_KEY_ENCRYPTION_KEY,
     MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY, etc. (see alchemy.run.ts for
     the full list)

Test plan

• bun --filter=@maple/api typecheck
• bun --filter=@maple/alerting typecheck
• bun --filter=@maple/db typecheck
• cd apps/api && bun test — 160/160 passing
• wrangler d1 migrations apply MAPLE_DB --local applies all 16
  drizzle migrations; re-run is a no-op
• Smoke test bun run dev (wrangler dev + local D1)
• Staging deploy via bun run deploy:stack
• Hit /health on the deployed Worker and verify one authenticated
  route against D1

🤖 Generated with Claude Code

[pullfrog]

no API key found. Pullfrog requires at least one LLM provider API key.

to fix this, add the required secret to your GitHub repository:

1. go to: https://github.com/Makisuo/maple/settings/secrets/actions
2. click "New repository secret"
3. set the name to your provider's key (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY)
4. set the value to your API key
5. click "Add secret"

configure your model at https://pullfrog.com/console/Makisuo/maple

for full setup instructions, see https://docs.pullfrog.com/keys

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ Triggered by Pullfrog ｜ Using Claude Opus ｜ 𝕏}