fix: umami proxy worker deploy steps

[chtnnh]

Know-Code-Verified: a3b2f9ff460069a4d7af7e462594cf8bd61f0858650731e61c31c3402a805388

[cursor]

PR Summary

Medium Risk
Changes Cloudflare Worker deploy order and secret binding for production analytics proxy; a bad deploy could leave /s/* unprovisioned or mis-bound, but PRs no longer deploy.

Overview
Fixes first-time Umami proxy provision: wrangler-action used to run secret bulk before the Worker existed, so the /s/* route looked configured in git while nothing was uploaded. CI now deploys, then secret put UMAMI_ORIGIN.

PRs that touch the proxy run unit tests plus wrangler deploy --dry-run; only main / workflow_dispatch deploy. Path helpers are extracted for Node tests, cache writes use waitUntil, and workers_dev stays off so the hostname never contains umami.

^{Reviewed by Cursor Bugbot for commit fa7fd65. Bugbot is set up for automated code reviews on this repo. Configure here.}