API capability pack for bounded Cloudflare REST operations against https://api.cloudflare.com/client/v4. Enroll a cloudflare API connection as a bearer-token connection backed by a scoped Cloudflare API token; no credential is embedded in the manifest. The pack verifies the token; reads accounts, zones, DNS records, Pages projects/deployments/domains, Worker script/deployment/route metadata, R2 buckets/object metadata, KV namespaces/key names, D1 database metadata, Queue inventory/metrics, and account audit logs; and supports approval-gated daily operations for creating/updating simple DNS records and purging specific cached URLs. It intentionally does not expose DNS record deletion, purge-everything, purge by tag/host/prefix, zone/account edits, Worker uploads or script content download, Pages deploy/retry/rollback actions, R2 object download/delete/upload, KV value reads/writes, D1 query/export/import, Queue message pull/send/purge, ruleset writes, token management, or arbitrary API passthrough.