[Due for payment 2026-11-03] Run the NewDot Cloudflare Worker in Miniflare during npm run web #104387

Problem

The NewDot Cloudflare Worker in web/cloudflare-worker sets the CSP, per-request script nonces, security headers, caching rules, and SPA routing. npm run web doesn't run it, so local development uses none of that behavior.

To run the Worker locally today, you have to install its dependencies separately, put a web build in dist/, and run wrangler dev on port 8787. Few developers do this. As a result, we find CSP and header problems on staging, where they become deploy blockers.

Solution

Make npm run web run the Worker locally in Miniflare (through wrangler dev), so every local session gets the same CSP, headers, and routing as staging and production.

• Install the Worker's dependencies as part of the normal App setup.
• Add the Worker to the concurrently command in npm run web, and open the browser to the Worker's origin.
• Have the Worker serve responses from the rsbuild dev server in development, so hot reload keeps working.
• Allow what local development needs in a development-only CSP, such as the HMR websocket and the API proxy on localhost:9000.
• Add an opt-out, like USE_WEB_PROXY=false for the proxy.
• Update the App README and web/cloudflare-worker/README.md.

Related: #38072

Reported by @roryabraham via DM with MelvinBot.