Add Gmail+Email Worker hybrid mail path and private runtime config

Prefer Cloudflare Worker KV for verification codes with optional short IMAP
fallback disabled for private deploy; track config.json/.env for private repo.
Also add worker project, protocol mint backoff, and fail-fast Turnstile/mail
timeouts from batch runs.

cf-email-worker/wrangler.toml

@@ -0,0 +1,26 @@
+# Cloudflare Email Worker for xAI verification codes
+# Deploy: cd cf-email-worker && npx wrangler deploy
+#
+# Required:
+#   1) Cloudflare Email Routing enabled for your domain
+#   2) Routing rule: catch-all → this Worker
+#   3) Optional Gmail forward destination (keeps IMAP fallback)
+
+name = "grok-xai-mail-codes"
+main = "src/worker.js"
+compatibility_date = "2024-11-01"
+
+# KV namespace for short-lived codes (create once, then bind id)
+#   npx wrangler kv namespace create GROK_MAIL_CODES
+[[kv_namespaces]]
+binding = "CODES"
+id = "REPLACE_WITH_KV_NAMESPACE_ID"
+preview_id = "REPLACE_WITH_KV_NAMESPACE_ID"
+
+[vars]
+# Shared secret for GET /code (also set via dashboard secrets if preferred)
+# CODE_API_KEY = "change-me"
+# Forward original mail to Gmail so IMAP fallback still works
+# GMAIL_FORWARD_TO = "you@gmail.com"
+# Code TTL seconds in KV
+CODE_TTL_SEC = "600"