cloud: drop hardcoded VITE_PUBLIC_SENTRY_DSN from wrangler.jsonc (#382)

The frontend Sentry DSN was committed in wrangler.jsonc `vars`. Move it
to a Wrangler secret (same pattern as SENTRY_DSN, DATABASE_URL, WORKOS_*)
so it's not in source and persists across every deploy path (secrets are
never deleted by deployments, regardless of --keep-vars).

The client bundle continues to get the value at build time via Vite
reading process.env.VITE_PUBLIC_SENTRY_DSN under `op run --env-file=.env.production`.

One-time setup after deploying this change:
  op run --env-file=.env.production -- sh -c 'printf "%s" "$VITE_PUBLIC_SENTRY_DSN" | bunx wrangler secret put VITE_PUBLIC_SENTRY_DSN'

Author: RhysSullivan

apps/cloud/src/env-augment.d.ts

@@ -11,6 +11,7 @@ declare global {
       AXIOM_TRACES_URL?: string;
       AXIOM_TRACES_SAMPLE_RATIO?: string;
       SENTRY_DSN?: string;
+      VITE_PUBLIC_SENTRY_DSN?: string;
 
       // Datastore (dev only — prod uses HYPERDRIVE binding)
       DATABASE_URL?: string;

apps/cloud/wrangler.jsonc

@@ -49,7 +49,6 @@
     },
   ],
   "vars": {
-    "VITE_PUBLIC_SENTRY_DSN": "https://e20b1bdeea27008092a4dc0ac303e97a@o4511196985556992.ingest.us.sentry.io/4511197010067456",
     "VITE_PUBLIC_SITE_URL": "https://executor.sh",
   },
 }