Native-binary WS backend goes behind Cloudflare Tunnel, not Pages

When an app serves a native engine (e.g. a Go/chess/analysis binary) to the browser over WebSocket, it cannot run on Cloudflare Pages/Workers: those are V8 isolates with no child_process, no native binaries, and no long-lived WS server. Run the whole same-origin Node app on a real host and front it with Cloudflare Tunnel (cloudflared) for public https/wss. Two gotchas: the app must trust X-Forwarded-Proto (cloudflared sets it to https) so Secure cookies and same-origin CSRF compute correctly, and any WS Origin allowlist must be set to the public URL because cloudflared can rewrite the Host header and break a same-host upgrade check.