infra: provision CDN for company blog and open-source project assets

[ctkm-aelf]

Summary

Stand up a public CDN to host markdown blog posts, images, and
open-source project assets (release artifacts, docs, demo files). This is
the content backend for the blog page and a general-purpose asset host for
our OSS work.

Motivation

• The blog page (feat(frontend): basic NyxID blog page with content preview #524) needs a CDN to fetch posts from
• Open-source projects need a stable, cacheable place to host release
  binaries, schema files, and embeddable demo assets
• Decouples content/asset publishing from the frontend deploy cycle

Scope

• Choose CDN provider (Cloudflare R2 + Workers, AWS S3 + CloudFront, or
  similar — propose options in a comment, pick one before implementation)
• Provision two top-level prefixes:
  • blog/ — published posts (markdown + assets)
  • blog/preview/ — unpublished drafts (token-gated)
  • oss/<project>/ — per-project asset folders
• Public read for blog/ and oss/; preview path gated by a shared secret
  or signed URL
• Custom domain (e.g. cdn.nyxid.dev) with TLS
• Cache headers tuned per content type (long TTL for hashed assets, short
  for markdown)
• Document upload workflow (manual aws s3 cp / wrangler steps for now;
  CI integration is a follow-up)

Out of scope

• Authoring UI
• Automated publishing pipeline (CI on a content repo) — follow-up
• Per-project access controls beyond public/preview

Acceptance criteria

• CDN bucket(s) provisioned and reachable on a custom domain over HTTPS
• Sample blog post renders correctly when fetched by the frontend
• Preview path requires the configured token / signed URL
• Upload workflow documented in docs/
• Cache + CORS headers verified for the frontend's fetch path

Notes

This unblocks #524. The blog page can ship against a placeholder bucket
in the meantime, but production cutover depends on this issue.

[chronoai-bot]

github-devloop intake decision: decline
Service class: standard

Reason:
Established IaC/production-change practice requires controlled cloud/DNS credentials and secret handling; provisioning cdn.nyxid.dev, TLS, CDN buckets, and blog/preview/ token gating necessarily needs human-gated production infrastructure access, with no sibling recurrence class identified.