Add Cloudflare Pages deploy pipeline (GitHub Actions + Wrangler)

- .github/workflows/deploy.yml: on push to main, stage site files into _site/
  and 'wrangler pages deploy' to the 'aetherweb' project (Direct Upload).
  Self-bootstrapping (creates the project on first run); gated on
  CLOUDFLARE_API_TOKEN so it skips cleanly (green) until secrets are set.
- README: full runbook — API token + account-id secrets, custom-domain attach
  (auto DNS + TLS), and apex->www redirect rule replacing the apex->GitHub one.

Author: patj

.github/workflows/deploy.yml

@@ -0,0 +1,57 @@
+name: Deploy to Cloudflare Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages-deploy
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    env:
+      # Mapped from the secret so we can gate steps on its presence — the
+      # `secrets` context isn't available directly in step `if:` conditions.
+      CF_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check configuration
+        if: ${{ env.CF_TOKEN == '' }}
+        run: |
+          echo "::notice::CLOUDFLARE_API_TOKEN not set — skipping deploy."
+          echo "Add CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID repo secrets to enable it."
+
+      # Stage only the files the site actually serves — keep serve.py,
+      # scripts/, dist/, README, and CI config out of the public deployment.
+      - name: Stage site
+        if: ${{ env.CF_TOKEN != '' }}
+        run: |
+          mkdir -p _site
+          cp -R index.html 404.html styles.css assets _headers _site/
+          [ -f _redirects ] && cp _redirects _site/ || true
+          echo "Staged:" && find _site -maxdepth 2 -type f | sort
+
+      # First run creates the project; later runs no-op (hence continue-on-error).
+      - name: Ensure Pages project exists
+        if: ${{ env.CF_TOKEN != '' }}
+        continue-on-error: true
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages project create aetherweb --production-branch main
+
+      - name: Deploy
+        if: ${{ env.CF_TOKEN != '' }}
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy _site --project-name=aetherweb --branch=main --commit-dirty=true

README.md

@@ -31,11 +31,42 @@ python3 serve.py           # http://127.0.0.1:4321
 python3 scripts/build.py   # writes dist/index.html with CSS + images inlined
 ```
 
-## Deploy
+## Deploy — Cloudflare Pages
 
-Cloudflare Pages pipeline — **to be added after design review.** The site is a
-plain static directory, so it deploys with zero build config (or `dist/` for the
-single-file variant).
+Deploys run from GitHub Actions via Wrangler (Direct Upload). Every push to
+`main` stages the site files into `_site/` and publishes them to the Pages
+project **`aetherweb`**. See [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml).
+
+### One-time setup
+
+1. **Create a Cloudflare API token** — Cloudflare dashboard → *My Profile → API
+   Tokens → Create Token → Custom token*. Permission: **Account → Cloudflare
+   Pages → Edit**. Scope it to the AetherSDR account.
+2. **Grab the Account ID** — *Workers & Pages* overview (right sidebar).
+3. **Add two repo secrets** — GitHub → *Settings → Secrets and variables →
+   Actions*:
+   - `CLOUDFLARE_API_TOKEN`
+   - `CLOUDFLARE_ACCOUNT_ID`
+4. **Push to `main`** (or run the workflow manually). The first run creates the
+   `aetherweb` Pages project and publishes it to `https://aetherweb.pages.dev`.
+
+### Domain (`www.aethersdr.com`)
+
+The zone is already on Cloudflare, so DNS and TLS are automatic:
+
+1. Pages project → **Custom domains → Set up a custom domain →
+   `www.aethersdr.com`**. Cloudflare auto-creates the proxied CNAME and
+   provisions the TLS cert.
+2. **Redirect the apex** — *Rules → Redirect Rules*: when hostname equals
+   `aethersdr.com`, 301 to `https://www.aethersdr.com` (preserving path/query).
+   This replaces the current apex → GitHub redirect. (If you still want a GitHub
+   shortcut, point `code.aethersdr.com` at it instead.)
+
+### Local manual deploy (optional)
+
+```bash
+npx wrangler pages deploy . --project-name=aetherweb --branch=main
+```
 
 ---