v2.38.0 — Clef-flash spam scoring and fewer billed requests

Highlights:

• Workers AI spam checks now use Cloudflare's Clef-flash decision model and score each comment. New optional SPAM_AI_THRESHOLD (1–100, default 70) sets the queue cut-off; also editable on /admin/settings.
• Fewer billed requests: /embed.js can be served from Workers Static Assets via a new [assets] block (npm run upgrade prints it), and the form-timing token is minted on first composer focus instead of at mount.
• Less KV and D1 load: settings use a 60 s per-isolate memo instead of a KV cache, reply notifications fan out in one query, and thread paging seeks on new indexes.

Notes for operators:

• Run npm run migrate — migration 0030 adds paging and retention indexes.
• To take /embed.js off the Worker quota, add [assets] on one line and directory = "./public" on the next at the end of wrangler.toml. Keep it below the top-level keys (name, main, routes, workers_dev): in TOML a key below a table header belongs to that table. Add it before npm run upgrade so the upgrade's deploy picks it up; if you add it later, run npm run deploy. Without it nothing breaks.
• Sign-out, token exchange and OAuth callback are now rate-limited. docs/ANTISPAM.md has an optional Cloudflare WAF rule for the sign-out route.
• Settings edits can take up to 60 s to reach every isolate.