feat: MPP compute /deploy endpoint — persistent hosting via MPP payment

[hellno]

Summary

Add a /deploy endpoint to the mpp-compute template that lets agents pay via MPP (Tempo stablecoins) to deploy code and get a persistent live URL for 24 hours.

This is Phase 2 of the MPP compute work. Phase 1 (/execute — instant code execution via Dynamic Workers) ships first as a separate PR.

Context

• Design doc: hellno-machine-payments-design-20260325-210759.md
• gakonst demand signal: "desperately need MPP-enabled compute & hosting"
• /execute (Phase 1) uses Dynamic Workers for instant sandboxed execution
• /deploy (this issue) uses Jack's existing deploy pipeline for persistent hosting

What /deploy does

Agent sends code + MPP payment ($0.10) → gets a live URL running their code for 24h.

Request:

POST /deploy
{
  "files": {
    "src/index.ts": "import { Hono } from 'hono';\nconst app = new Hono();\napp.get('/', (c) => c.json({ hello: 'world' }));\nexport default app;"
  },
  "name": "my-api"
}

Response (after MPP payment):

{
  "url": "https://hellno-my-api.runjack.xyz",
  "deployment_id": "dep_abc123",
  "expires_at": "2026-03-27T21:00:00Z",
  "ttl_hours": 24
}

Architecture

The /deploy endpoint is a thin MPP payment gateway in front of Jack's existing control plane:

1. Validate files (size ≤ 500KB, non-empty)
2. MPP charge $0.10 (Tempo pathUSD)
3. Bundle with esbuild-wasm (same as apps/mcp-worker/src/bundler.ts)
4. Create project via control plane API (POST /v1/projects)
5. Upload deployment via POST /v1/projects/{id}/deployments/upload
6. Store expiry in KV: deploy:{project_id} → TTL 24h
7. Return URL with payment receipt

Prerequisites

• Extract bundler to shared package: Move apps/mcp-worker/src/bundler.ts to packages/bundler/ to avoid DRY violation (both MCP worker and template need it)
• jkt_ service token: Template needs a static API token to call the control plane. The jkt_ token system already exists — just needs to be created during jack new setup via .jack.json hooks
• KV binding: For deploy metadata storage (TTL-based expiry tracking)

Key Decisions

Decision	Choice	Rationale
Bundler location	Shared packages/bundler/	DRY — MCP worker + template both need it
Auth to control plane	Existing jkt_ tokens	Already works for all API routes, zero CP changes
Deploy cleanup	KV TTL metadata, no auto-delete in V1	CF doesn't charge for idle Workers; add cleanup cron in V2
npm resolution	None in V1	Files must be self-contained or use URL imports

Error Responses

Code	Status	Meaning
missing_files	400	files field missing or empty
code_too_large	413	Total file size exceeds 500KB
bundle_failed	422	esbuild bundling failed (syntax error, missing import)
deploy_failed	502	Control plane rejected the deployment

Effort Estimate

• Human: ~1 week
• CC: ~4 hours (includes shared bundler extraction)

Depends On

• /execute endpoint (Phase 1) — ships first, establishes the template structure
• Shared bundler package extraction from MCP worker