Make admission alerts precede authority

[ael-dev3]

What changed

• fixes Cloudflare notification delivery by using manual redirect handling with fail-closed status classification
• stages an idempotent alert against the exact pending access-request generation
• requires Farcaster provider acceptance before Hermes mutates admission for opted-in players
• validates founder eligibility, credentials, Realm graph state, and resource state before the notification gate
• preserves rollback-compatible consent storage and self-heals mixed-version delivery state
• tombstones replaced tokens and adds privacy-safe delivery diagnostics
• recognizes both pending-request and legacy epoch notification launches in the Mini App

Why

The prior Worker used a redirect mode that Cloudflare rejected before issuing the provider subrequest. Admission could therefore become visible while its notification remained in transport retry. This change fixes that transport boundary and changes normal admission ordering so provider handoff is established first.

Farcaster provider acceptance is evidence of handoff, not proof that a device displayed or opened the notification. The pre-admission copy therefore says that Realm access is being finalized.

Validation

• full repository check: 2,996 tests, TypeScript, production build, asset/provenance checks, Mini App verification
• auth bridge: 308 unit tests, 12 Workerd tests, both TypeScript checks
• focused operator/Mini App suites: 104 tests
• clean diff validation