[P2][Deferred][Cloudflare] billing・collaboration Workersをsame-origin stagingへ配備する

[Hosi121]

Parent / dependency roles

• Parent: [P2][Deferred][Epic][SaaS] Studioをmulti-tenant SaaS実行基盤へ移行する #116
• Native hard blocker: [P2][Deferred][Infra] staging managed PostgreSQL・Hyperdrive authorityを構築する #431（staging PostgreSQL / Hyperdrive）
• Completed provenance: [P0][Collaboration] session・membership失効後の既存WebSocketをboundedにrevokeする #432（collaboration authorization revocation）
• Integration peers: [P2][Deferred][Cloudflare] account-control-plane Workerを配備しOIDC endpointsをedge rate-limitする #312（account Worker）、[P0][Billing] Stripe subscription・local entitlement・usage reservationを実装する #303 / [P0][Billing] Stripe Sandbox実E2EでCheckoutからrender admissionまで証明する #328（billing）、[P0][Collaboration] project-scoped Durable Objectでshared edit vertical sliceを通す #304（collaboration vertical slice）
• Final consumer: [P2][Deferred][Canary] same-origin stagingでaccount・billing・collaboration・exportを統合証明する #372

Problem

The account Worker has an explicit staging deployment Issue (#312), but billing and collaboration deployment are currently implicit inside the final canary. Their custom routes, Hyperdrive bindings, distinct rate-limit namespaces, Durable Object migration, Stripe secrets, disabled preview/log surfaces, and smoke evidence have no independent owner.

Goal

Deploy the billing control plane and editor collaboration Worker/Durable Object to the same private staging origin as the reviewed web/API build, with production-shaped bindings and denial evidence.

Acceptance criteria

• exact same-origin routes expose only the documented billing and collaboration endpoints
• workers_dev and preview URLs are disabled
• distinct caching-disabled Hyperdrive and least-privilege database roles are pinned
• every rate-limit namespace is present, unique per route/environment, and fails closed when unavailable
• Durable Object class/migration and room namespace are pinned to the reviewed deployment version
• Stripe test secret/webhook secret and other credentials are Worker secrets, never vars, files, logs, traces, or artifacts
• invocation logs/traces and unsafe request URL/body logging remain disabled
• billing status/Checkout/webhook denial and collaboration upgrade/presence/head/revocation smoke cases pass on the custom staging domain
• Worker version, route, bindings, migration head, and reviewed git commit are recorded without secrets
• rollback disables the routes or restores the previous reviewed Worker version without accepting mixed contracts

Non-goals

• live-mode Stripe charging
• public GA traffic
• implementing billing or collaboration semantics already owned by [P0][Billing] Stripe subscription・local entitlement・usage reservationを実装する #303/[P0][Collaboration] project-scoped Durable Objectでshared edit vertical sliceを通す #304