Deploy dragonfly-loader staging Cloudflare Access cutover

[import-pandas-as-numpy]

Summary

• bump the staging dragonfly-loader CronJob to the merged Cloudflare Access image
• update the loader infra docs from the old Auth0 contract to the Cloudflare Access service-token contract
• record the staging Cloudflare Access token rotation without storing secret values in git

Validation

• confirmed dragonfly-loader image sha-9f67b5bfcab22089deef147902532c3c9f17d90b was published from main
• updated dragonfly-loader-env in do-sfo3-staging to BASE_URL, CF_ACCESS_CLIENT_ID, and CF_ACCESS_CLIENT_SECRET
• applied the updated CronJob manifest in staging
• ran kubectl --context do-sfo3-staging -n dragonfly create job --from=cronjob/dragonfly-loader dragonfly-loader-manual-20260404-1802
• verified job/dragonfly-loader-manual-20260404-1802 completed successfully