feat(deploy/site): serve the apex from the same Pages project, no redirect rule

Vercel was doing the apex->www 308 itself (its "redirect to www" project
setting), so nothing about Cloudflare requires a redirect — the behaviour
just disappears with Vercel. Rather than rebuild it with a zone Redirect
Rule plus a proxied placeholder record, attach pcbjam.com as a SECOND
custom domain on pcbjam-site. Both hosts serve the site and the pages
already emit canonical=www, which is what consolidates them for search.

That drops the riskiest artefact in the migration. Redirect Rules are
zone-scoped and run BEFORE Workers/Pages routing, so a `contains` match
instead of `eq` would 308 app./editor./demo./api. to www — breaking the
product API, not just a marketing page. The sibling hosts are also the
reason this was worth avoiding rather than merely guarding.

APEX_MODE (lib/common.sh) selects the topology, defaulting to `serve`.
08-verify-prod.sh now dispatches through assert_apex: in serve mode it
requires the apex to answer 200 with no hop, to not be a stale Vercel
response, to declare canonical=www, and to expose /api/waitlist. The
`redirect` mode and 07's rules/apex phases are kept for the alternative.

08 also checks the attached domains via wrangler rather than the REST API,
so the whole serve-mode path needs only `wrangler login` — no zone scopes
at all.

Comments that explained themselves via the old redirect are corrected:
astro.config.mjs, web/standalone/src/lib/config.ts and
scripts/deploy/build-demo.mjs. The demo keeps posting to www — not because
the apex redirects, but because a CORS preflight cannot follow one, so
aiming at a host that might ever redirect is a latent breakage.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr

deploy/site/lib/common.sh

@@ -23,6 +23,13 @@ APEX_BASE="${APEX_BASE:-https://pcbjam.com}"
 VERCEL_PROJECT="${VERCEL_PROJECT:-pcbjam}"
 VERCEL_TEAM="${VERCEL_TEAM:-pcbj-am}"
 VERCEL_DNS_TARGET="${VERCEL_DNS_TARGET:-dcfb2907091b7240.vercel-dns-016.com}"
+# How the apex behaves. Two supported topologies:
+#   serve    (default) apex is a SECOND Pages custom domain and serves 200. No
+#            redirect rule, no placeholder record — the same two clicks as any
+#            other host. Pages still emit canonical=www so search consolidates.
+#   redirect apex 308s to www via a zone Redirect Rule + proxied placeholder
+#            record. This is what Vercel did, and needs zone DNS/rules scopes.
+APEX_MODE="${APEX_MODE:-serve}"
 WRANGLER="${WRANGLER_CMD:-npx --yes wrangler@4}"
 
 mkdir -p "$STATE_DIR/state" "$STATE_DIR/stamps" "$STATE_DIR/baseline" "$STATE_DIR/logs"