Reference auth-proxy worker (examples/)

[ramboz]

Part of #66

Problem

~80% of a real BYO integration is the same glue: an edge worker that hides the engine's API key, reads/mints the visitor id, calls the engine, and returns a normalized decision. Every customer rebuilds it.

Proposal

A reference auth-proxy worker under examples/:

• a Cloudflare entry + a framework-neutral core (portable to other runtimes),
• hides the API key (server-side secret),
• reads/mints the visitor-id cookie,
• calls the engine and returns the normalized decision (per the contract sub-issue),
• documented env/secret setup + a minimal engine stub so it runs standalone.

Acceptance criteria

• examples/ worker that runs with documented setup.
• Key never reaches the client; visitor-id read/mint handled server-side.
• Emits decisions conforming to the client ⇄ engine contract.
• README wiring it to the client resolver hook.