Decouple Directus from project

docs/cloudflare-worker.md

@@ -52,6 +52,33 @@ CF_WORKER_NAME=swansea-airfield-test
 
 For Directus, use public HTTPS URLs in Worker env files. Do not use Docker-only hostnames such as `http://directus:8055` outside Docker Compose.
 
+Use `DIRECTUS_TOKEN` for the read-only token Astro uses at build time. `DIRECTUS_ADMIN_TOKEN` is still supported for older local setups, but production/test deploy files should prefer `DIRECTUS_TOKEN`.
+
+To make Astro print Directus fetch diagnostics during a build, set:
+
+```env
+DIRECTUS_DEBUG=true
+```
+
+This logs collection reads, folder/file reads, and the reason an image folder fell back to bundled images.
+
+For image-backed pages, the build token needs read access to:
+
+```text
+news
+events
+event_dates
+event_templates
+notices
+fuel_prices
+documents
+contacts
+directus_files
+directus_folders
+```
+
+The homepage and cafe image rotators specifically call `/folders` and `/files`, so `directus_folders` read permission is required in addition to `directus_files`.
+
 ## Directus Assets From R2
 
 Local development can keep using Directus asset URLs. For test and production Worker builds, set one of these optional values in `.env.worker.test` and `.env.worker.prod` to make the generated Astro HTML point at R2-hosted files instead: