feat(phasefinal-web): cloudflare edge config — cache ruleset + always online

Cache rule on www.phasefinal.com with edge and browser TTL both respect_origin,
so cache policy stays declared once in nginx.conf rather than split between the
repo and the dashboard. Always Online enabled, which is what actually survives
an origin outage; a 300s document TTL alone would only mask five minutes.

Verified: document and assets both reach cf-cache-status HIT, apex 301s to www,
edge email obfuscation active.

stacks/phasefinal-web/cloudflare/cache-ruleset.json

@@ -0,0 +1,14 @@
+{
+  "rules": [
+    {
+      "expression": "(http.host eq \"www.phasefinal.com\")",
+      "action": "set_cache_settings",
+      "action_parameters": {
+        "cache": true,
+        "edge_ttl":    { "mode": "respect_origin" },
+        "browser_ttl": { "mode": "respect_origin" }
+      },
+      "description": "PFI site: cache eligible, honour origin Cache-Control (policy lives in stacks/phasefinal-web/conf/nginx.conf)"
+    }
+  ]
+}