infra: service-binding topology + per-service wrangler environments

[tomymaritano]

Context

Prepare the Workers plumbing before any code split: how services name/bind each other, staging+production per service, secrets layout.

Acceptance criteria

• wrangler.toml template per service: staging + production envs, service bindings declared, Turso secrets pattern
• api.dripnex.app routing implemented in DNS/Workers routes (initially everything → existing monolith worker; per-path peel-off as services land)
• Secrets inventory per service (TURSO_*, JWT_SECRET, RESEND, STRIPE, LICENSE_SIGNING) — least privilege, no service gets secrets it does not need
• Local multi-service dev verified: wrangler dev ×2 with a working service binding

Depends on

Service boundaries RFC.