docs: mark Cloudflare as verified-production fallback

GITHUB-CLOUDFLARE-SETUP.txt

@@ -1,19 +1,35 @@
-CATERIUM - GITHUB -> CLOUDFLARE AUTODEPLOY
+CATERIUM - CLOUDFLARE FALLBACK DEPLOYMENT
+
+PRIMARY PRODUCTION:
+https://app.caterium.ru
+Timeweb Cloud App Platform
+Branch: production
+Publish directory: public
 
 Repository:
 https://github.com/pavlov346346-source/caterium-app
 
-Existing Worker:
+Fallback Worker:
 ancient-sound-04ab
 
-1. Run PUSH-TO-GITHUB.bat.
-2. Complete GitHub browser login if Git Credential Manager asks.
-3. In Cloudflare: Workers & Pages -> ancient-sound-04ab -> Settings -> Builds -> Connect.
-4. Choose GitHub and repository pavlov346346-source/caterium-app.
-5. Production branch: main
-6. Root directory: /
-7. Build command: npm run check:deploy
-8. Deploy command: npx wrangler deploy
-9. Save and deploy.
+Cloudflare is a backup target only. Do not treat it as the primary production host.
 
-After this, each push to main that passes the Cloudflare build checks deploys to the same Worker.
+Recommended fallback Git configuration:
+1. Workers & Pages -> ancient-sound-04ab -> Settings -> Builds -> Connect.
+2. Choose GitHub and repository pavlov346346-source/caterium-app.
+3. Branch: production
+4. Root directory: /
+5. Build command: npm run check:deploy
+6. Deploy command: npx wrangler deploy
+7. Save.
+
+The production branch is promoted automatically only after Caterium QA succeeds on main, so the fallback should follow production rather than main.
+
+Manual fallback deployment from a verified checkout:
+npm ci
+npm audit --audit-level=high
+npm run check:deploy
+npm run test:e2e
+npm run deploy:cloudflare-backup
+
+Do not decommission the fallback Worker until Timeweb/DNS/SSL and real-user production checks are complete.