Harden signed user token identity forwarding

[stainlu]

Summary

• Strip caller-supplied cf-access-authenticated-user-email before forwarding authenticated requests to the Fleet Durable Object.
• Prefer the authenticated x-crabbox-owner context when resolving request ownership, while keeping the Access email header as a fallback.
• Document the signed-token forwarding behavior and add a regression test for spoofed identity headers.

Verification

• npm run format:check --prefix worker
• npm run lint --prefix worker
• npm run check --prefix worker
• npm test --prefix worker
• npm run build --prefix worker
• node scripts/build-docs-site.mjs
• npm run check
• git diff --check