feat(images): Cloudflare Workers AI image provider (commit 1a)

First commit of the image + Instagram A/B pipeline workstream. Ships the
Cloudflare Workers AI image provider, its pricing + validator helpers,
four new settings fields in a new "Images" admin section, and unit tests
with mocked HTTP. Nothing calls the provider yet from the article
pipeline — integration lands in commit 1b.

Why: CEO-approved on 2026-04-15 (see
convo/prautoblogger/threads/2026-04-image-pipeline/01-cto-handoff.md).
Style is locked to the 90s infomercial pastiche; default model is FLUX.1
[schnell] at ~$0.0011/MP (~$0.01/article for 8 images across 4 placements
x 2 variants).

Risk flags:
- Direct call to Cloudflare Workers AI bypassing AI Gateway (decision
  D-001, documented in convo/prautoblogger/decisions/). Gateway route
  to Workers AI currently 403s; OpenRouter gateway path unaffected.
- prab_event_log structured writes deferred to commit 1b when the
  table lands (decision D-002). Logger-based logging is in place now.
- No schema changes. No existing code paths touched outside settings.
- Backward compatible: provider is instantiable but not wired to any
  consumer yet.

Test plan:
- CI runs PHPUnit including the new CloudflareImageProviderTest.
- After merge: verify the new Images section appears on the settings
  page, the style-suffix textarea pre-fills with the infomercial prompt,
  and entering the existing CLOUDFLARE_AI_TOKEN + account UUID lets a
  future "Test Connection" button return OK (button ships in a later
  commit; the underlying validate_credentials_detailed() works today).

Files:
- includes/providers/interface-image-provider.php   (adopted from CTO draft)
- includes/providers/class-cloudflare-image-provider.php  (283 lines)
- includes/providers/class-cloudflare-image-pricing.php   (78 lines)
- includes/providers/class-cloudflare-image-validator.php (107 lines)
- includes/admin/class-settings-fields.php (+ Images section, 4 fields)
- prautoblogger.php (+ PRAUTOBLOGGER_DEFAULT_IMAGE_MODEL, _STYLE_SUFFIX)
- tests/unit/Providers/CloudflareImageProviderTest.php
- ARCHITECTURE.md (file tree, integrations table, options table, decision #16)
- CONVENTIONS.md (How To: Add a New Image Provider)
- CHANGELOG.md (Unreleased section)

Agent-Session: cowork-2026-04-15-image-pipeline-commit-1a

CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to PRAutoBlogger will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project uses [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Added
+- **Image provider: Cloudflare Workers AI (FLUX.1 family).** First commit of
+  the image + Instagram A/B pipeline workstream. Ships the provider, its
+  pricing + validator helpers, four new settings fields in a new "Images"
+  admin section, and unit tests with mocked HTTP. Nothing calls the provider
+  yet from the article pipeline — integration lands in commit 1b.
+  - `includes/providers/interface-image-provider.php` (adopted from the CTO's
+    uncommitted draft) — contract for any image provider.
+  - `includes/providers/class-cloudflare-image-provider.php` — FLUX on Workers
+    AI, direct call to `/accounts/{id}/ai/run/...` (bypassing AI Gateway per
+    decision D-001); exponential-backoff retries on 429 / 5xx / network,
+    loud fail on 4xx; handles both raw-bytes and JSON-envelope response shapes.
+  - `includes/providers/class-cloudflare-image-pricing.php` — model alias →
+    full Workers AI id resolution + per-megapixel cost estimation.
+  - `includes/providers/class-cloudflare-image-validator.php` — non-destructive
+    "Test Connection" credential check that never generates a real image.
+  - Settings: `prautoblogger_cloudflare_ai_token` (encrypted),
+    `prautoblogger_cloudflare_account_id`, `prautoblogger_image_model`
+    (schnell / dev), `prautoblogger_image_style_suffix` (default = CEO-locked
+    90s infomercial prompt).
+  - Constants: `PRAUTOBLOGGER_DEFAULT_IMAGE_MODEL`,
+    `PRAUTOBLOGGER_DEFAULT_IMAGE_STYLE_SUFFIX`.
+  - Tests: `tests/unit/Providers/CloudflareImageProviderTest.php` covers
+    happy path (raw bytes + JSON envelope), dimension + empty-prompt
+    validation, 4xx loud-fail without retry, unexpected response shape,
+    cost scaling across models and dimensions, and missing-token diagnostics.
+- ARCHITECTURE.md: new key decision #16 (image pipeline: Cloudflare Workers
+  AI), new external API integration row, new options rows, file tree updates.
+- CONVENTIONS.md: new "How To: Add a New Image Provider" section.
+
 ## [0.2.2] — 2026-04-12
 
 ### Changed