docs: add a repeatable read-only account audit to the free-tier guide

[codethor0]

Goal

Turn a one-time live check of the Cloudflare account into a repeatable audit, so the no-charge boundary can be verified rather than assumed.

What the live check found (2026-09-18, production v0.7.0)

• No KV namespaces, D1 databases, Queues, Vectorize indexes, Hyperdrive configs, or Secrets Store stores.
• R2 is not enabled on the account (API error code 10042). R2 was the resource whose Free-plan overage behavior is not documented as hard-fail, so this is the safest possible state.
• Secret list is empty.
• The live version has exactly one binding, RATE_LIMITER, a fetch handler only, and the compatibility date and flags from wrangler.jsonc.

Not readable with Wrangler, so still a dashboard check: the plan (must read Free) and the live non-versioned observability settings.

Scope / non-goals

Documentation only: the command list and expected results in docs/security/FREE_TIER.md, a checklist line in docs/security/CLOUDFLARE.md, and a changelog line. No runtime, config, dependency, or version change. All commands are read-only.

Public contract

None.

Security impact

• No new secret or credential handling
• No new outbound network access
• No new persistence or user data
• No new runtime dependency
• Threat model updated if attack surface changed -- unchanged

Verification

• Tests added or updated when behavior changed -- no behavior change
• npm run verify
• git diff --check
• Public docs and OpenAPI updated if behavior changed
• Change is intentionally scoped and contains no unrelated cleanup

🤖 Generated with Claude Code