Define a platform port and isolate Cloudflare bindings in apps/worker

[devarshishimpi]

Why

Cloudflare-specific infrastructure is currently a business-logic dependency. AppBindings from src/server/env.ts is passed into DB modules, sessions are written straight to APP_KV in src/server/core/sessions.ts, and orchestration lives in a Workflow class in src/server/workflows/review.ts that also carries retry and phase semantics. None of that can be unit-tested without emulating Cloudflare.

Scope

• Define platform ports in packages/core/src/ports: a key-value store, a job orchestrator/scheduler, a queue, and a secret store.
• Create apps/worker as the only place that imports @cloudflare/workers-types, declares bindings, and reads wrangler.jsonc. Move src/server/index.ts, env.ts, worker-env.d.ts, wrangler.jsonc and worker-configuration.d.ts here. It wires bindings into port implementations and mounts the (still-existing, not yet extracted) API app.
• Move the durable-execution mechanics out of src/server/workflows/review.ts: step boundaries and retry policy become an orchestrator port implementation in apps/worker/src/ports, while the Workflow class itself shrinks to a thin adapter. Preserve the current lease/recovery semantics in src/server/db/jobs-leases.ts and src/server/core/job-recovery.ts exactly.
• Reimplement sessions (src/server/core/sessions.ts) as an in-memory-testable SessionStore port with a KV-backed implementation in apps/worker/src/sessions.ts.
• Point cf-typegen at apps/worker only.

Acceptance criteria

• @cloudflare/workers-types and wrangler appear only in apps/worker.
• Every new port has an in-memory implementation usable in tests.
• Job lifecycle, lease renewal and recovery behave identically to main.
• npm run deploy is unchanged from the operator's point of view.