chore: Replace temporary Fastly API token with automation token

[dcadenas]

Summary

The Fastly sync path already uses a Worker secret, but the safe rotation process was not written down in the repo.
This change adds a runbook for replacing a personal Fastly token with an automation token and checking that D1-to-Fastly KV sync still works.
It matters because the real token must be created by an operator and stored as a Cloudflare secret, not committed in code.

Motivation

The root problem is operational, not a runtime token-handling bug.
The Worker already reads FASTLY_API_TOKEN; the missing part was a repeatable process for creating, installing, and verifying the automation token.

Related Issue

• Part of Replace temporary Fastly API token with automation token #45

Validation

The docs-specific test passes, and the admin UI builds.
The full root test suite is still blocked by an existing origin/main failure in src/routes/admin-sync.test.ts, unrelated to this docs-only diff.

• npm run test:once
• npm run build:admin
• relevant local Wrangler validation if applicable
• I could not run some validation locally, and I explained why below

Manual Test Plan / Notes

After a Fastly superuser creates the automation token, run npx wrangler secret put FASTLY_API_TOKEN.
Then call POST /api/admin/sync/fastly and confirm the response reports failed as 0.

• git rebase origin/main
• npm run test:once -- src/docs/runbooks.test.ts
• npm run build:admin
• npm run test:once failed on GET /admin/username/:name/nip05-status > returns not_applicable for non-active usernames; expected not_applicable, received missing.

Visuals / API Examples

• No visual change
• Screenshots, sample payloads, or logs attached if needed

Public Artifact Review

• Titles, descriptions, branch names, and screenshots avoid partner, customer, brand, campaign, or other sensitive external names unless explicitly approved

[dcadenas]

@rabble could you run this rotation? I can’t create the Fastly automation token because I’m not a Fastly superuser. The runbook in this PR has the required steps.