fix(cloudflare): warn when the default SESSION KV binding will be auto-provisioned

[edwardwc]

Changes

• The adapter injects a SESSION KV binding with no id, which Wrangler treats as a
  request to auto-provision a namespace on deploy. That needs an API token with
  Workers KV Storage: Edit, so deploys without it fail with a generic
  Authentication error [code: 10000] against /storage/kv/namespaces — after the
  build already succeeded, and with nothing in the message pointing back at sessions.

• astro build now warns when that binding is about to be provisioned, naming the
  permission and both escape hatches:

  [@astrojs/cloudflare] The "SESSION" KV binding has no `id`, so `wrangler deploy` will
  provision a new KV namespace. This requires an API token with the "Workers KV Storage:
  Edit" permission.
    To use an existing namespace, add `kv_namespaces: [{ binding: "SESSION", id: "<id>" }]`
    to your Wrangler config.
    To skip sessions entirely, set `session: false` in your Astro config.
  

• Silent when the user already declared the binding, when session: false, and during
  dev (which never provisions anything). Deduplicated to one warning per build, since
  the customizer runs once per worker (entry, prerender, previews).

• No change to the emitted Wrangler config. The existing
  !needsSessionKVBinding || hasSessionBinding ternary is extracted into a named
  injectsSessionBinding so the warning condition and the emission condition can't
  drift apart, but the output is identical.

• The warning lives in cloudflareConfigCustomizer rather than the astro:config:setup
  hook because that's the only place that knows whether an id-less binding is actually
  being emitted — warning from index.ts would also fire for users who correctly
  declared SESSION with an id.

Closes #17640

Testing

Five cases added to the existing test/session-false.test.ts, which already covers the
sibling session: false behavior: warns with both key phrases, dedupes across workers,
silent when user-declared, silent when sessions disabled, and doesn't throw without a
logger.

Being upfront about verification: the suite imports from dist/, so it needs a full
monorepo install and build, which I did not run locally. I verified the logic by
compiling wrangler.ts standalone and running the same assertions plus three
regressions asserting binding emission is unchanged (8/8 passing). The committed test
file itself has therefore not been executed, and tsc -b is unconfirmed — I'd
appreciate CI confirming both.

Docs

No docs change needed: this adds no API or config surface, and the new logger option
is internal to the customizer.

That said, the underlying gotcha — that a default-on adapter feature makes deploy
require Workers KV Storage: Edit — isn't currently called out on the Cloudflare
sessions docs page, and arguably should be.

/cc @withastro/maintainers-docs for feedback!

[changeset-bot]

🦋 Changeset detected

Latest commit: a72f3c2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 43 packages

Name	Type
@astrojs/cloudflare	Patch
@test/astro-cloudflare-node-prerender-mdx	Patch
@test/astro-cloudflare	Patch
@test/astro-cloudflare-allowed-hosts	Patch
@test/astro-cloudflare-astro-dev-platform	Patch
@test/astro-cloudflare-astro-env	Patch
@test/astro-cloudflare-binding-image-cache	Patch
@test/astro-cloudflare-binding-image-service	Patch
@test/astro-cloudflare-cache-provider-wait-until	Patch
@test/astro-cloudflare-cache-provider	Patch
@test/astro-cloudflare-client-address	Patch
@test/astro-cloudflare-compile-custom-image-service	Patch
@test/astro-cloudflare-compile-image-service	Patch
@test/astro-cloudflare-custom-entryfile	Patch
@test/astro-cloudflare-custom-image-service	Patch
@test/astro-cloudflare-dev-image-endpoint	Patch
@test/astro-cloudflare-external-image-service	Patch
@test/astro-cloudflare-external-redirects	Patch
@test/cloudflare-incremental-images	Patch
@test/astro-cloudflare-internal-redirects	Patch
@test/astro-cloudflare-no-output	Patch
@test/astro-cloudflare-prerender-node-env	Patch
@test/astro-cloudflare-prerender-queue-consumers	Patch
@test/astro-cloudflare-prerender-styles	Patch
@test/astro-cloudflare-prerenderer-errors	Patch
@test/astro-cloudflare-prerenderer-render-error	Patch
@test/routing-priority-cloudflare	Patch
@test/cf-server-entry	Patch
@test/astro-cloudflare-server-island-prerender-framework	Patch
@test/astro-cloudflare-sessions	Patch
@test/astro-cloudflare-sql-import	Patch
@test/cf-ssr-deps	Patch
@test/astro-cloudflare-static	Patch
@test/astro-cloudflare-svelte-rune-deps	Patch
@test/astro-cloudflare-top-level-return	Patch
@test/cf-user-optimize-deps	Patch
@test/astro-cloudflare-vite-plugin	Patch
@test/astro-cloudflare-with-base	Patch
@test/astro-cloudflare-with-react	Patch
@test/astro-cloudflare-with-solid-js	Patch
@test/astro-cloudflare-with-svelte	Patch
@test/astro-cloudflare-with-vue	Patch
@test/astro-cloudflare-wrangler-preview-platform	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR