Add Cloudflare Worker SDK server example

[JW-Rami]

Summary

• Add a Cloudflare Worker server example with health, SDK status, private-transfer, and LP routes.
• Add a server-side Invisible SDK adapter that uses only public package entrypoints when the package is available.
• Add LP create, recover, DKG, funding, reconcile, refill, and withdrawal through SDK-owned LP actions.
• Protect /private-transfer and /lp with bearer auth, streaming body limits, non-200 failure statuses, fail-closed attestation config, and explicit legacy preview DCAP collateral fallback.
• Add Wrangler config, concise OSS docs, CI, simulation, SDK package verification hook, and security guidance.

Test

• npm run prepare:sdk
• npm run typecheck
• npm run build
• npm run check:contract
• npm run simulate
• npm run verify:sdk
• npm run audit:high
• npx wrangler deploy --dry-run
• npx wrangler deploy
• curl /health, /sdk, /private-transfer, and /lp

Notes

• Cloudflare Workers support outbound WebSocket clients; this example keeps Invisible coordinator traffic server-side.
• The SDK requires DCAP collateral by default. Production usage needs a coordinator that emits dcap_collateral or a compatible attestation manifest.
• releasePin.allowMissingDcapCollateral is documented only as a temporary non-production preview escape hatch and is rejected in prod mode.
• @invisible/sdk is installed as an alias to the currently published private GitHub Packages build @invisible-labs/sdk@0.1.0-dev.1.2.

[JW-Rami]

Compatibility note: the current live coordinator may still speak an older wire contract, while the SDK package used by this example expects the matching coordinator and wire-contract rollout. Once that rollout is live, the SDK and coordinator will use the same message names and payload shapes, so the example should work end-to-end. Until then, a compatibility error before transfer/deposit creation is expected and does not indicate an issue in this example integration.