NL-02: CF shared worker + per-host sitemap for newsletter.{domain} hosting

- lib/cloudflare.ts: CF API helpers (zone lookup, DNS CNAME upsert, Workers Custom Domains CRUD, worker script upload) - lib/cf-newsletter-worker.ts: shared worker script template — one worker serves all newsletter.{domain} hosts, routes to origin /p/{domain} archive, serves /sitemap.xml from origin API - app/api/newsletter-host/sitemap/route.ts: per-host sitemap.xml endpoint listing that domain's published issues - app/api/admin/newsletter-hosts/route.ts: admin API to deploy worker + bind custom domains (supports dryRun) - scripts/deploy-newsletter-hosts.mjs: CLI deploy script with DRY_RUN mode for ops