docs: serve the docs from Cloudflare instead of GitHub Pages

[thomaspinder]

Important

Draft until the Impulso staging deploy (QuantClimate/Impulso#373) checks out. Merging this PR moves gpjax.quantclimate.com to Cloudflare on the first deploy.

Motivation

GitHub Pages serves the docs, outside the Cloudflare zone that serves the rest of quantclimate.com. Because of that, Cloudflare Web Analytics cannot see the docs (see #796 and #798). The landing page is a Cloudflare Worker that serves static assets, and Cloudflare adds the analytics beacon to it at the edge with no code in the repo. This PR serves the docs the same way.

Solution

• docs/wrangler.jsonc: a Worker named gpjax-docs that serves the Sphinx build as static assets on the custom domain gpjax.quantclimate.com. It has no Worker code and no workers.dev URL. On the first deploy, Wrangler replaces the DNS-only CNAME to quantclimate.github.io with the Worker's custom domain.
• html_handling: "none" serves each file at exactly the URL Sphinx gives it, so /page.html stays /page.html. Cloudflare's default mode would redirect every .html URL to an extensionless one, away from the canonical links and the sitemap.
• docs/_redirects (copied to the site root by html_extra_path) serves / and /dir/ from their index.html. This keeps the 87 sphinx-reredirects stubs working, and with them the old MkDocs URLs that the legacy host forwards.
• build_docs.yml: the build job uploads a plain artifact instead of a Pages artifact. deploy-docs runs wrangler deploy (Wrangler 4.145.0, Node 24) instead of actions/deploy-pages. Only deploy-docs gets the CLOUDFLARE_API_TOKEN org secret and the CLOUDFLARE_ACCOUNT_ID org variable. The notebook build never sees them.
• docs/CNAME is removed, because nothing reads it now. legacy-docs-redirect/README.md now names Cloudflare as the host.

GitHub Pages stays enabled in the repo settings. It gets no new deploys, but quantclimate.github.io/GPJax/… links keep redirecting to the custom domain, and the last Pages deploy is available for a rollback.

Verification

I ran these locally with Wrangler 4.145.0 against the current production build (the github-pages artifact from main):

• wrangler deploy --dry-run --config docs/wrangler.jsonc: the config is valid and Wrangler reads 1092 files.
• wrangler dev with this exact config:
  • These return 200: /, /index.html, /installation.html, /installation/ (redirect stub), /_examples/classification/ (MkDocs-era stub), /examples/classification.html, /api/distributions/, /search.html?q=kernel, /objects.inv, /sitemap.xml, /searchindex.js, /_static/basic.css, /_images/GP.svg, /benchmarks/ and an asv JSON file whose path contains spaces.
  • /nope.html returns 404.
• zizmor 1.30.1 (the locked version, with online audits) reports no findings. actionlint passes.

Rollback

Revert this PR, delete the gpjax.quantclimate.com custom domain from the gpjax-docs Worker, and recreate the DNS-only CNAME gpjax → quantclimate.github.io.

🤖 Generated with Claude Code

https://claude.ai/code/session_015fagcMeo1LmLG2Dg3NybmQ

[github-actions]

📖 Docs preview: https://pr-799--endearing-crepe-c2d5fe.netlify.app

Smoke render — the expensive notebooks run with reduced budgets, so
figures are not publication fidelity. /render-mode.txt says smoke.