Scraping protection now runs in the WAF before Workers (
fa5c6cd)
Moves the frontend anti-scraping checks out of the LB Worker and into Cloudflare WAF phases, so throttled requests are blocked before any Worker invocation happens. That reduces wasted compute on scraper traffic and keeps the raw module-serving path untouched.
Other misc changes
- Removed the old LB-side docs/diff/source route limiter and its helper/tests.
- Added WAF/Terraform configuration and CI coverage for the new protection path.