feat(stats): collect CDN access logs and publish download statistics

Add an hourly download-stats pipeline that reads the cran-rpkgs Bunny
access logs into a download_stats schema in the build metadata database
and publishes aggregated counts to /stats/downloads.json for the
rpkgs.com /stats page.

- Classify each request (download, index, redirect reason, probe, noise)
  mirroring the edge router, and split cloud/CI networks from the rest.
- De-duplicate downloads per client, package version and day, and key
  clients on a salted HMAC so no IP is stored or published.
- Exclude our own CI runners and record run windows to show gaps.
- Declare the zone's logging settings and allow CORS for JSON.

cdn.tf

@@ -164,6 +164,23 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
 
   add_canonical_header = true
 
+  # Access logs feed the public download statistics (`stats/`, published to
+  # `/stats/downloads.json`). Both settings were already on; declaring them
+  # keeps an apply from quietly switching off the only source of that data.
+  # Bunny keeps the logs for three days, which is why `download-stats` runs on
+  # a schedule. IPs stay anonymized to /24 (/64 for IPv6) at the edge.
+  log_enabled          = true
+  log_anonymized       = true
+  log_anonymized_style = "OneDigit"
+
+  # The rpkgs.com website reads `/stats/downloads.json` from the browser, so
+  # JSON needs the CORS header too. The rest is the zone's existing list.
+  cors_enabled = true
+  cors_extensions = [
+    "css", "eot", "gif", "jpeg", "jpg", "js", "json", "mp3", "mp4", "mpeg", "png", "svg", "ttf", "webm", "webp",
+    "woff", "woff2",
+  ]
+
   cache_stale = ["offline", "updating"]
 
   block_ips = var.cdn_block_ips