Edge proposal gate for Cloudflare Pages hosting
Added a Cloudflare Pages Function (functions/proposals/_middleware.js) that enforces the proposal password at the edge, replacing the Eleventy dev-server middleware that today forces the site to run as a paid Node web service on DigitalOcean. With the gate at the edge, the site can deploy as pure static output (_site) on Cloudflare Pages — no origin server, no health-check fragility, ~$0 hosting.
The Function is a faithful port of the .eleventy.js gate: same proposal_access_granted cookie, same 401 password form, same ?pw= prefill, password from the PROPOSAL_PASSWORD env var (default ShapeTomorrow). Cookie is now also Secure; SameSite=Lax. Covered by test/proposals-gate.test.mjs.
This is additive — the DigitalOcean deploy and its Eleventy middleware are untouched, so nothing changes until the Cloudflare Pages cutover. See the "Cloudflare Pages hosting" section in readme.md for the cutover steps.