Remove legacy intake authentication

[isPANN]

Summary

• require GitHub-backed Cloudflare Access in both the submit client and Worker
• remove the PRB_API_KEY fallback, CLI option, tests, and public documentation
• make an empty R2 incoming queue valid by tolerating a null Contents list
• document the working cloudflared login flow for new submitters

Verification

• uv run pytest -q (231 passed, 4 skipped)
• npm test (5 passed)
• npm run check (Wrangler dry-run bundle passed)
• submit skill quick validation passed
• empty jq queue probe passed

The production PRB_API_KEY Worker secret has already been deleted after the successful Access-only end-to-end test.