Add Cloudflare Containers provider prototype

[luisdalmolin]

Summary

• add a Cloudflare provider option to LaravelService while preserving AWS as the default
• deploy the Laravel web image through Cloudflare Containers and a generated Worker
• manage Wrangler deploy, update, and delete through a Pulumi dynamic resource
• forward environment variables at runtime and upload configured environment files as Worker secrets
• link one sst.cloudflare.D1 database to the REST-based erimeilis/laravel-cloudflare-d1 driver without a Worker database proxy
• inject the linked database ID and optional Cloudflare account ID while requiring the D1 API token as an explicit runtime secret
• configure Laravel's database cache store to use the linked D1 connection for basic cache operations
• link one sst.cloudflare.Bucket to Laravel's S3 filesystem through R2's S3-compatible API without a Worker storage proxy
• inject the bucket name, region, and account-scoped endpoint while requiring scoped R2 access keys as explicit runtime secrets
• add sizing inference, custom domains, fixed stateless pools, scale-to-zero, placement constraints, health checks, and observability
• reject unsupported AWS-specific options explicitly

Current scope

This is an experimental web-only prototype. Workers, Reverb, VPC, links other than one D1 database and one R2 bucket, AWS roles and permissions, deployment scripts, and RemoteEnvVault are intentionally unsupported.

The Laravel application must install erimeilis/laravel-cloudflare-d1, configure its d1 database connection, provide a scoped CLOUDFLARE_D1_API_TOKEN through the runtime environment file, and run the standard Laravel cache table migration.

Basic database-cache operations such as get, put, remember, add, and forget use D1. Cache tags are not supported. The driver's buffered transaction model is not compatible with cache increments, decrements, or atomic locks; applications needing those operations should use a Redis-compatible cache.

The Laravel application must install league/flysystem-aws-s3-v3 and provide bucket-scoped AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY values through the runtime environment file. The component configures the standard s3 disk against the linked R2 bucket. Jurisdiction-specific endpoints and public bucket URLs can be overridden through normal Laravel environment variables.

Verification

• npm test — 85 tests passed
• npm run build
• standalone Cloudflare Worker bundle validation
• npm pack --dry-run
• git diff --check
• stale proxy, binding, hostname, previous-driver, and embedded-credential reference scan

No live Cloudflare resources were created while validating this branch.