ops: provision cdn.databayt.org CNAME + AWS creds for crawler

[abdout]

Tracking the manual user-only steps to unblock kun#7 (crawler) and hogwarts#272 (CNAME migration).

Subdomain: cdn.databayt.org. Specific CNAME overrides the *.databayt.org wildcard that previously routed it to hogwarts.

Step 1 — DNS ✅ DONE

vercel dns add databayt.org cdn   CNAME d1dlwtcfl0db67.cloudfront.net
vercel dns add databayt.org @     CAA   '0 issue "amazon.com"'

• dig +short CNAME cdn.databayt.org → d1dlwtcfl0db67.cloudfront.net.
• dig +short cdn.databayt.org → CloudFront IPs (52.85.32.x)
• CAA includes amazon.com (required for ACM)

Step 2 — ACM cert ✅ DONE

• Cert ARN: arn:aws:acm:us-east-1:446731258367:certificate/c1a8a0ee-fedd-46d9-8994-4b95929e0454
• Validation CNAME added via Vercel CLI
• Status: Issued at 2026-04-25 20:16

Step 3 — CloudFront alternate domain ✅ DONE

• Distribution E3PHDXTDSBCQSJ (d1dlwtcfl0db67.cloudfront.net) updated
• Alternate domain name: cdn.databayt.org
• Custom SSL: cert from Step 2 attached
• Security policy auto-upgraded to TLSv1.3_2025

Step 4 — Verify CNAME live ✅ DONE

HTTP/2 200
content-type: image/svg+xml
cache-control: public, max-age=31536000, immutable
server: AmazonS3

curl -sI https://cdn.databayt.org/icons/ic-wa-archived-24.svg returns 200.

Step 5 — Configure AWS creds for kun crawler ✅ DONE

Reused existing hogwarts-s3-uploader IAM user creds (AKIAWQA2CBH7ZGROHY4S, also used by hogwarts) — copied 3 env vars from hogwarts/.env to kun/.env. No new IAM key needed.

Step 6 — Run actual crawl 🟡 IN PROGRESS

pnpm crawl:anthropic running. Expecting ~546 new uploads → data.ts append → pnpm build.

Step 7 — Merge the PRs (after Step 6 completes)

• Merge feat: ready cdn.databayt.org migration (do not merge until CNAME verified) hogwarts#272
• Merge feat: anthropic asset crawler — fetch + categorize + upload to s3 #7

Step 8 — Flip Vercel env (hogwarts only)

• Vercel hogwarts → Settings → Environment Variables → set NEXT_PUBLIC_CDN_DOMAIN=cdn.databayt.org (Prod + Preview + Dev)
• Trigger redeploy
• Spot-check production: WhatsApp icons load from cdn.databayt.org

Step 9 — Optional: flip kun's CDN_BASE

- export const CDN_BASE = "https://d1dlwtcfl0db67.cloudfront.net";
+ export const CDN_BASE = "https://cdn.databayt.org";