Public sites perf · Phase 4: hosted CDN adapter #74

Part of the public-site performance plan (master issue linked above). Depends on Phase 3. This is the only vendor-specific step, and it applies to hosted FrontLit only. The core must not depend on it.

Goal

Put a global edge cache in front of hosted FrontLit, using the Phase 3 purge mode and a first-party adapter.

Tasks

• Choose the vendor (Cloudflare for SaaS, CloudFront SaaS Manager, Bunny, Fastly, ...). Criteria:
  • custom-hostname TLS at scale, including apex domains (CUSTOM_DOMAIN_A_RECORDS)
  • purge by tag or surrogate key
  • tiered cache / origin shield
  • stale-if-error support
  • preserving the query string in the cache key (_rsc)
  • cost per hostname and per request
• Write the adapter (Cloudflare, perf(sites): Cloudflare purge adapter and real-user Web Vitals (#74) #145) behind the Phase 3 purge(tags[]) interface.
• Decide where custom-domain TLS lives: Caddy on-demand TLS (as today) or the vendor's custom-hostname feature. Update apps/sites/docs/custom-domains.md and the domain verification targets.
• Enable tiered cache / origin shield. Optionally warm the most-visited URLs from the sitemap after a purge.
• Real-user monitoring: (perf(sites): Cloudflare purge adapter and real-user Web Vitals (#74) #145) a Web Vitals beacon plus cache hit ratio and TTFB dashboards.

Targets

• Cache hit ratio above 95%.
• TTFB p75 under 100ms on cache hits.
• LCP under 1.5s, CLS under 0.1, INP under 200ms.