Test site: DNS moves to the fleet nameservers, no Cloudflare proxy

cnxvinyl.lol's zone now lives in cnx-network-clan (ns1/ns2.cnx.network),
pointing straight at s1; mail is on mx1. Live once the nameservers at
Porkbun are switched.

- site/Caddyfile mirrors what s1 runs (checked 2026-10-23): no
  cloudflare_only or security_headers imports; Caddy gets its own certs.
- deploy-site.yml: drop the Cloudflare cache purge step and its secrets.
- site/README.md and digital-factory.md: DNS and certificate notes.

.gitea/workflows/deploy-site.yml

@@ -10,9 +10,6 @@ name: Deploy test site
 #   VPS_PORT                          optional, default 22
 #   VPS_KNOWN_HOSTS                   optional pinned host key line(s);
 #                                     without it the key is scanned per run
-#   CLOUDFLARE_ZONE_ID, CLOUDFLARE_API_TOKEN
-#                                     optional; cache purge for cnxvinyl.lol
-#                                     (token needs Zone > Cache Purge)
 
 on:
   push:
@@ -111,25 +108,8 @@ jobs:
           echo "live on server: $live"
           [ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }
 
-      - name: Purge Cloudflare cache
-        env:
-          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-        run: |
-          if [ -z "$CLOUDFLARE_ZONE_ID" ] || [ -z "$CLOUDFLARE_API_TOKEN" ]; then
-            echo "::warning::CLOUDFLARE_ZONE_ID / CLOUDFLARE_API_TOKEN not set; skipping cache purge"
-            exit 0
-          fi
-          response=$(curl -sS -X POST \
-            "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache" \
-            -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
-            -H "Content-Type: application/json" \
-            --data '{"purge_everything":true}')
-          echo "$response"
-          echo "$response" | grep -q '"success":\s*true' || { echo "::error::Cloudflare cache purge failed"; exit 1; }
-
       - name: Check the public URL
-        # Warning only: DNS, Cloudflare or a basic_auth login can make this
+        # Warning only: DNS or a basic_auth login can make this
         # fail while the files on the server are already correct.
         run: |
           expected=$(cat site/dist/version.txt)