fix: correct Cloudflare routing so `ipfs.calibration.filbeam.io` reaches the `ipfs-retriever`

[BravoNatalie]

Part of #297

Description

ipfs.calibration.filbeam.io is intended to be the ipfs-retriever's bare root domain, handling /wallet/cid redirect requests. In practice it routes to the piece-retriever instead, because the piece-retriever's zone-level wildcard route *.calibration.filbeam.io/* matches first. The ipfs-retriever's custom domain entry for ipfs.calibration.filbeam.io in the Cloudflare dashboard does not override it.

As a result, requests to ipfs.calibration.filbeam.io/{wallet}/{cid} are mishandled by the piece-retriever, which parses the wallet address as a piece CID and returns Invalid CID: 0x…. The redirect only works via link.ipfs.calibration.filbeam.io, which correctly hits the more specific *.ipfs.calibration.filbeam.io/* route.

Additionally, the dashboard contains stale legacy entries from the filcdn.io domain on both workers, and none of the routing config is codified in wrangler.toml.

Proposed solution

1. Add an explicit route ipfs.calibration.filbeam.io/* to the ipfs-retriever so it takes precedence over the piece-retriever's wildcard. Remove the non-functional custom domain entry for that hostname.
2. Delete legacy filcdn.io routes and custom domains from the piece-retriever dashboard.
3. Move all routes for both workers into their respective wrangler.toml files under [env.calibration] and [env.mainnet] so routing is version-controlled and survives redeployment.

Done criteria

• https://ipfs.calibration.filbeam.io/{wallet}/{cid} returns a 302 redirect to the correct 1-{base32DataSetId}-{base32PieceId}.ipfs.calibration.filbeam.io slug URL
• *.calibration.filcdn.io/* and calibration.filcdn.io routes removed from piece-retriever dashboard
• Routes for both workers defined in wrangler.toml under [env.calibration] and [env.mainnet]
• Deployed routes match what was previously configured manually in the dashboard

Notes

• link.ipfs.calibration.filbeam.io continues to work during the fix — it is the safe fallback and matches the *.ipfs.calibration.filbeam.io/* route correctly
• Both the bare domain check (env.DNS_ROOT.slice(1)) and the link check (`link${env.DNS_ROOT}`) in ipfs-retriever/bin/ipfs-retriever.js are correct