Apex cutover and Cloudflare Pages teardown

Direct cutover, no staging. Order matters because Traefik's TLS-ALPN cannot issue behind Cloudflare's proxy: the record must go to the VPS grey-cloud, and Pages must outlive the flip as the rollback.

• Deploy the stack to the VPS; seed and verify the prod database via the pipeline
• Lower apex TTL, add the router labels, flip the apex A record to 159.195.47.245 grey cloud; first requests trigger cert issuance (brief window accepted)
• Verify cert, site, admin, Umami, R2 assets; add the www record
• Only then: delete the Pages project, wrangler.jsonc, CF deps, and content.json (post-seed-verification) in one PR; calendar reminder for the ~60-day renewal