security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets

000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md

@@ -4,15 +4,17 @@ status: "active"
 folder: "000-configs/tools"
 tags: [tool, cloudflare, workers, r2, d1, kv, ai, hosting]
 created: "2026-07-29"
-updated: "2026-07-29"
-version: "1.1.0"
+updated: "2026-07-30"
+version: "1.2.0"
 ---
 
 # Cloudflare Platform Instructions
 
 Cloudflare is the **hosting and edge platform** for this workspace. Use Workers (serverless functions), Pages (static sites), R2 (object storage), D1 (SQLite at the edge), KV (key-value), Workers AI, and the Agents SDK.
 
-Credentials are in `[[000-shit_admin/cloudflare]]` (admin-only file, read at runtime — never commit or paste publicly).
+Credentials are in `/home/user/.env.cloudflare` (server-only file, chmod 600, NOT in repo). Load with `source /home/user/.env.cloudflare`.
+
+Admin placeholder: `[[000-shit_admin/cloudflare]]` (gitignored, just points to the env file).
 
 ## Quick Reference
 
@@ -40,8 +42,11 @@ npx wrangler whoami
 If `wrangler login` is not possible in the environment, set the API token directly:
 
 ```bash
-export CLOUDFLARE_API_TOKEN="<token from admin doc>"
-export CLOUDFLARE_ACCOUNT_ID="<account id from admin doc>"
+# Load from server-only .env file
+source /home/user/.env.cloudflare
+# or set manually:
+export CLOUDFLARE_API_TOKEN="<token>"
+export CLOUDFLARE_ACCOUNT_ID="<account id>"
 ```
 
 **Verify token works:**