fix(cdn): align repository routing across pull zones (#165)

## Motivation

`cran.rpkgs.com` and `cran.allianceswisspass.devxy.io` serve the same B2 repository through separate Bunny pull zones, but only the first zone was managed and purged after weekly reindexing.
This allowed the Alliance endpoint to retain stale repository metadata and left locked `renv` restores unable to retrieve versions whose binary archive object was absent.

## Changes

- Adopt the Alliance SwissPass pull zone `3265648` into OpenTofu and configure it with the shared B2 origin and middleware script.
- Purge both Bunny pull zones after the weekly rebuild reindex.
- Preserve the requested public hostname in middleware redirects.
- Redirect missing archived binaries to the corresponding CRAN source package, checking whether the version is archived or still current.
- Cover the existing archived-binary passthrough behavior in the edge routing matrix.

## Verification

- `prek run -a`
- `just edge-test`
- `crow lint .crow/`
- `tofu validate`
- `bash -n scripts/purge_cdn_zone.sh`

## Deployment

Run `tofu apply` to adopt pull zone `3265648`, publish the middleware release, and align both pull zones.
After the apply, rerun the Alliance SwissPass CI restore that requested `cli 3.6.5` and `AzureStor 3.7.1`.

Reviewed-on: #165

cdn.tf

@@ -32,7 +32,7 @@
 #   cache_stale           = ["offline", "updating"]
 #   use_background_update = true
 
-  # block_ips = var.cdn_block_ips
+# block_ips = var.cdn_block_ips
 
 #   # 50 TB
 #   limit_bandwidth = 50000000000000
@@ -82,7 +82,7 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
 
   cache_expiration_time = 31919000
   websockets_enabled    = false
-  errorpage_whitelabel = true
+  errorpage_whitelabel  = true
 
   origin {
     type              = "OriginUrl"
@@ -147,6 +147,58 @@ resource "bunnynet_pullzone_hostname" "cran_rpkgs_com" {
   tls_enabled = true
 }
 
+# Alliance SwissPass historically used a separate, manually configured pull
+# zone. Adopt it so both public repositories use the same B2 origin, middleware
+# release and cache behavior.
+import {
+  to = bunnynet_pullzone.cran_allianceswisspass
+  id = "3265648"
+}
+
+resource "bunnynet_pullzone" "cran_allianceswisspass" {
+  name = "cran-allianceswisspass"
+
+  cache_errors          = false
+  cache_expiration_time = 31919000
+  websockets_enabled    = false
+  errorpage_whitelabel  = true
+
+  origin {
+    type              = "OriginUrl"
+    url               = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
+    middleware_script = bunnynet_compute_script.rpkgs_router.id
+  }
+
+  routing {
+    filters = [
+      "scripting",
+    ]
+  }
+
+  s3_auth_enabled = true
+  s3_auth_key     = var.B2_S3_ACCESS_KEY
+  s3_auth_secret  = var.B2_S3_SECRET_KEY
+  s3_auth_region  = "eu-central-003"
+
+  cache_enabled              = true
+  request_coalescing_enabled = true
+  block_post_requests        = true
+  cache_vary_headers         = ["User-Agent"]
+
+  limit_requests    = 5000
+  limit_connections = 1000
+
+  safehop_enabled      = true
+  add_canonical_header = true
+  cache_stale          = ["offline", "updating"]
+  block_ips            = var.cdn_block_ips
+
+  # 50 TB
+  limit_bandwidth = 50000000000000
+
+  block_root_path = true
+}
+
 # resource "bunnynet_storage_zone" "devxy-r-binaries" {
 #   name      = "devxy-r-binaries-storage"
 #   region    = "DE"