Step 2.5 in deploy.js was env-blind, so 'npm run deploy:dev' falsely
reported reusing the production KV while wrangler silently fell back to
the env binding. Combined with [env.development] inheriting top-level
routes, dev deploys could also hijack the production custom domain.
Make extractWorkerName / injectKvNamespaceId / findExistingKvId accept
an envName parameter, and preserve [env.development].routes across
Sync Upstream merges so 'routes = []' overrides survive upgrades.
Comment out all [[kv_namespaces]] in wrangler.toml (both production and
development) so deploy.workers.cloudflare.com no longer creates an empty
"2fa" KV. Updated deploy.js to handle fully commented KV config: search
for existing "SECRETS_KV" namespace first (exact match only), create one
if not found, then inject the binding block into wrangler.toml before
deploying.
