Add a [cdn] section and purge the edge after publishing

The site is about to sit behind Cloudflare, where the public pages will be
allowed to live at the edge for a day (`s-maxage`, next commit). That is only
correct if the edge is emptied the moment a new issue lands, so the origin now
does the emptying itself rather than leaving it to an operator to remember.

`[cdn]` is inert by default: with no `provider` nothing is called and no token
is needed, so an origin with no CDN behaves exactly as before. Setting
`provider = "cloudflare"` without both a zone id and `DAILY_EPUB_CDN__API_TOKEN`
is a config error — a half-configured purge would publish into a stale edge and
say nothing.

The purge is `purge_everything` on purpose. A new issue changes more than its
own page: `/`, `/issues`, `/feed.xml`, `/issues.json`, and the previous issue's
page too, whose "latest" nav marker moves. A per-URL list of that set is exactly
the kind of thing that silently rots, and everything expensive at the edge is
content-hashed, so refilling it costs one origin fetch.

A purge failure is logged at warn and never fails the run: the paper is already
published and recorded by then, and a few stale hours are not worth failing over.
`daily-epub cdn purge` runs the same code by hand; it takes no run lock because
it touches neither the database nor the publish directories.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Va5eMEmWEnjMXBsBob5FDW

config.example.toml

@@ -220,3 +220,19 @@ journal_lines = 300                  # job-page journal tail; valid range 10..=5
 # routes remain public. A signed-in web user can download without Basic auth.
 # basic_auth_user = "daily"
 # basic_auth_pass = "..."
+
+# [cdn]
+# The CDN in front of the origin. Leave the whole table out (the default) and
+# nothing here applies: no purge is attempted and no token is needed.
+#
+# provider = "cloudflare"            # the only recognised value today
+# cloudflare_zone_id = "..."         # zone id from the Cloudflare dashboard overview
+# purge_after_publish = true         # purge the edge after `generate` publishes (dry runs never do)
+#
+# api_token via DAILY_EPUB_CDN__API_TOKEN env; never put it in this file.
+# The token needs exactly one permission — Zone -> Cache Purge — scoped to this
+# one zone. Nothing else is called, so nothing else should be granted.
+#
+# Setting `provider` without both the zone id and the token is a config error.
+# See docs/runbooks/cdn-rollout.md for the zone settings and cache rules that
+# make the origin's Cache-Control headers actually apply at the edge.