cf-access-wall — declarative Access provisioning

Zero Trust free tier covers 50 seats; Access attaches directly to *.workers.dev hostnames (verified live 2026-07-23 — no zone, no domain purchase). One Access app offers BOTH login paths on a single screen: GitHub for developers, emailed 6-digit code for non-technical staff (no account creation). Enforcement is real: unauthenticated requests 302 to the team login page.

Self-Evolving Skill: Cloudflare's API/dashboard drift → fix scripts + the dashboard-forge Vendor Quirks log immediately on real breakage.

Flow