fix(deploy): configure pnpm allowBuilds and add Cloudflare deployment setup

README.md

@@ -31,6 +31,41 @@ ddev exec php artisan tinker storage/app/e2e-admin-seed.php
 | `pnpm test` | vitest (API client envelope/refresh/error tests) |
 | `pnpm gen:api` | regenerate `src/api/types.gen.ts` from the backend's scribe-admin OpenAPI spec (`../gig-platform/public/api-docs/admin/openapi.yaml`; run `ddev exec php artisan scribe:generate --config scribe-admin` there first) |
 
+## Deploy
+
+The app is a client-rendered SPA served as static assets by a Cloudflare Worker
+(`wrangler.jsonc`, `not_found_handling: single-page-application`). The build
+emits `_shell.html`, which is copied to `index.html` so Cloudflare's SPA
+fallback returns it for every client route.
+
+**Manual deploy** (needs `wrangler login` or `CLOUDFLARE_API_TOKEN` /
+`CLOUDFLARE_ACCOUNT_ID` in your env):
+
+```bash
+pnpm cf:deploy    # vite build → copy shell to index.html → wrangler deploy
+```
+
+**CI/CD** — every push & PR runs typecheck + test + build; pushes to `main`
+build and deploy to Cloudflare. Two mirrored pipelines are provided:
+
+| Platform | Workflow |
+| --- | --- |
+| GitHub Actions | `.github/workflows/ci.yml` |
+| Gitea Actions | `.gitea/workflows/ci.yml` |
+
+Configure these on the repo before the first deploy:
+
+| Type | Name | Value |
+| --- | --- | --- |
+| Variable | `VITE_API_BASE_URL` | backend API origin baked into the build |
+| Secret | `CLOUDFLARE_API_TOKEN` | token with "Edit Cloudflare Workers" scope |
+| Secret | `CLOUDFLARE_ACCOUNT_ID` | Cloudflare account id |
+
+- GitHub: *Settings → Secrets and variables → Actions*.
+- Gitea: *Repo → Settings → Actions → Secrets / Variables*. Actions must be
+  enabled and an `act_runner` registered with the `ubuntu-latest` label (use an
+  image such as `catthehacker/ubuntu:act-22.04`).
+
 ## Architecture notes
 
 - **Auth**: Bearer tokens in localStorage (zustand persist). `src/api/client.ts`