* feat(tenants): add tenants resource SDK mapping

Production promotion of staging MR !931 (PT-2567). Adds the tenants
top-level resource and the user.tenants subresource (GET /user/tenants)
to enable SDK/docs coverage for tenant-api public routes documented
under the No Private APIs initiative.

JIRA: PT-2567

* feat(ct_alerter): add CT alerting subscription endpoint mappings

* feat(ai_gateway): add custom_providers resource

…tes for magic-on-ramps

* fix(api): remove unnecessary skip_test_reason from ipsec_tunnels psk_set

psk_set was carrying a copied "TODO: investigate broken test" skip, but it is a new endpoint whose generated test has never run. Its closest analogue psk_generate (also POST) is unskipped and passes, and psk_set does not share the modified_ipsec_tunnel response wrapper that breaks the update/bulk_update tests. Removing the skip so the test runs; if it genuinely fails downstream it can be re-added with a concrete reason.

* fix(api): remove app_policies mapping from magic-on-ramps

app_policies has no implementation in conduit-api and none is planned, so mapping GET /accounts/{account_id}/magic/sites/{site_id}/app_policies would document a route that does not exist. Removing the skipped entry; psk_set and cf1_sites are unaffected.

* fix(api): add models, terraform, skip guards for magic-on-ramps resources

- Add skip_test_reason to psk_set (aligns with sibling update/bulk_update)
- Add skip guard to app_policies (aligns with sibling app_configuration)
- Add terraform.name and models block to cf1_sites
- Add models block to cf1_sites.ramps sub-resource

* feat(api): map cf1_sites and ramps for magic-on-ramps

Add cf1_sites resource with CRUD methods and ramps sub-resource
to magic_transit in Stainless config for SDK generation.

Ref: APIX-667, APIX-795

* feat(api): map ipsec_tunnels/psk and sites/app_policies for magic-on-ramps

Add Stainless config mappings for two undocumented routes from APIX-667:
- ipsec_tunnels.psk_set: POST /accounts/{account_id}/magic/ipsec_tunnels/psk
- sites.app_policies.list: GET /accounts/{account_id}/magic/sites/{site_id}/app_policies

…quarantine releases

* feat(email_security): Add API to do bulk message movements and quarantine releases

* feat(lex): add Log Explorer to SDK config

* feat(casb): publish CASB APIs to public SDK

* feat(casb): publish CASB APIs to public SDK

…ration

* feat(codegen): bootstrap stlc workspace for TypeScript prod migration

- Remove `mcp_server` from `typescript` target options: stlc-mcp is not
  bundled in the codegen image; add back once image is updated.
- Commit TypeScript custom-code tracking baseline. integrated SHA
  matches cloudflare/sdks/cloudflare-typescript@main HEAD at
  f1c9d92.
- Add codegen-typescript-prod job mirroring codegen-go-prod and
  codegen-python-prod: same image, same runner, manual-only
  artifact-only. Reuses ci/scripts/codegen-target.sh.

Phase-1 rollout keeps the job manual-only and forces artifact-only
behavior via CODEGEN_TRIGGER_BRANCH=__never__. After parity check
passes, a follow-up MR enables auto-push for all prod targets in
lockstep.

Pattern matches !973 (Go prod migration) and !974 (Python prod
migration).

…ST unlock [EMAIL-1815]

* feat(email_routing): add PATCH addresses/{id} and deprecated POST unlock [EMAIL-1815]

Adds SDK method bindings for the two undocumented routes covered by
EMAIL-1815, against the OpenAPI spec merged in cloudflare/email/email-fwdr-api!912:

- email_routing.addresses.edit -> PATCH /accounts/{account_id}/email/routing/addresses/{destination_address_identifier}
- email_routing.unlock -> POST /zones/{zone_id}/email/routing/unlock
  (marked deprecated; skip terraform — canonical: PATCH /zones/{zone_id}/email/routing/dns)