feat: bind SERVER_API_TOKEN from Secrets Store

[imconnorngl]

Summary

Adds secrets_store_secrets bindings for SERVER_API_TOKEN to the production and development environments in wrangler.jsonc, sourcing the server API key (skycrypt-server-api-key) from Cloudflare Secrets Store instead of a plain Worker secret.

Secrets Store bindings expose the value via an async get() rather than a plain string, so custom-instance.ts now reads the token straight from the Worker binding:

const token = event?.platform?.env.SERVER_API_TOKEN ?? envPrivate.SERVER_API_TOKEN;
const serverApiToken = typeof token === "string" ? token : await token.get();

In local vite dev, CI prerender, and anywhere else the platform proxy is used, the value is a plain string from the process env or .env, so get() is only called on the real binding. App.Platform in app.d.ts types it as string | { get(): Promise<string> }.

Also ran oxfmt on wrangler.jsonc so pnpm lint passes.

Verification

• svelte-check: 0 errors
• eslint on changed files: clean
• pnpm build (including prerender) passes locally
• Not yet exercised against a real Secrets Store binding; worth a quick check on the preview deploy that X-API-Token arrives at the backend.