Sync CLI with current Static Studio contracts

[patrickposner]

Summary

• add Cloudflare Turnstile-protected email OTP login with loopback browser, request-only, and verify-only flows
• align site provisioning, replacement artifacts, domains, backups, PHP versions, and client-visible fields with current Studio contracts
• remove retired runtime-policy and migration-log surfaces, require migration-backed site creation, and document the 0.3.0 library migration
• harden upload recovery, signed completion clock skew, and multi-domain removal behavior
• prepare npm release 0.3.0 with Node 20-compatible dependencies

Validation

• clean npm ci
• Node 20 typecheck
• 21 test files / 184 tests
• Node 20 build and declarations
• npm audit --audit-level=high (0 vulnerabilities)
• npm pack plus fresh consumer install and ESM import
• production Turnstile site key rendered on the real 127.0.0.1 callback without hostname errors