ops(phasefinal-web): dedicated infra-ops-pages token; apex->www as a Cloudflare Redirect Rule

stacks/phasefinal-web/README.md

@@ -31,19 +31,16 @@ rather than broken, which is the failure mode you won't notice.
 stacks/phasefinal-web/deploy-pages.sh        # conf/site → Pages production (branch main)
 ```
 
-Needs a vaulted Cloudflare token with Account → Cloudflare Pages: Edit (see the script).
-⚠ The 2026-10-04 migration used jackdaw's token as a one-off; a dedicated
-`nh3-dev/.config/cloudflare/infra-ops-pages-token` is pending Prime. Check the result on
-the per-deploy preview URL wrangler prints before trusting the custom domains.
+Uses the account token `infra-ops-pages` (vault `nh3-dev/.config/cloudflare/infra-ops-pages-token`).
+Check the result on the per-deploy preview URL wrangler prints before trusting the custom domains.
 
 ## DNS and redirects
 
 `www.phasefinal.com` and `phasefinal.com` → CNAME `phasefinal.pages.dev`, Cloudflare-proxied
 (both are Pages custom domains). Cloudflare-proxied is also what provides the email-address
-obfuscation the contact block relies on. ⚠ **The apex no longer 301s to www**: Traefik used
-to do that, Pages `_redirects` cannot redirect between hostnames, and no vaulted token may
-create a zone Redirect Rule. Both hostnames serve the site until Prime mints a token with
-Single Redirect: Edit; then add the rule `phasefinal.com/* → https://www.phasefinal.com/${1}` (301).
+obfuscation the contact block relies on. **The apex 301s to www through a zone Redirect Rule**
+(`http_request_dynamic_redirect` entrypoint, path and query kept), since Pages `_redirects` cannot
+redirect between hostnames. Traefik did this before the move.
 
 ## Lesson from the ana-docker era (2026-08-29)