fix(api): support HEAD requests

[caio-pizzol]

Summary

• allow API HEAD requests and advertise GET, HEAD, OPTIONS in CORS headers
• return cheap no-body HEAD responses for /stats, /documents, /manifest, and unknown routes without running expensive DB-backed GET handlers
• share manifest filename/header construction between HEAD /manifest and GET /manifest
• include .github/workflows/deploy-site.yml in the site deploy path filter so workflow-only deploy fixes trigger automatically

Verification

• git diff --check
• bun run lint
• bun run typecheck
• bun run test
• bun run build
• bun run --cwd apps/web typecheck (0 errors, existing Astro hints only)
• bun run --cwd apps/web/worker deploy --dry-run
• local runtime dispatch smoke for HEAD /stats, HEAD /documents, HEAD /manifest, HEAD /missing, OPTIONS /stats, and POST /stats

Note

Direct tsc --noEmit -p apps/web/worker/tsconfig.json is not currently a useful gate: installing the worker package exposes pre-existing Cloudflare Workers vs Node global type conflicts plus older Neon row typing issues in untouched code. Wrangler dry-run verifies the worker bundle path used for deploy.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!