feat(cluster-apps): manage tunnel-fronted CNAMEs in TF

[xnoto]

Summary

The cloudflare-operator owns the cluster-apps tunnel and configures the cloudflared deployment to route hostnames it sees in TunnelBindings — but it does not write DNS records. Without a CNAME pointing each FQDN at <tunnel-id>.cfargotunnel.com, requests reach Cloudflare's edge but error out with 530 / 1033 (no tunnel route for hostname).

This PR:

• Adds a data "cloudflare_zero_trust_tunnel_cloudflared" "cluster_apps" lookup by name (cluster-apps-k3s) so the tunnel ID resolves at plan time without being hard-coded in TF
• Adds a for_each cloudflare_dns_record covering argocd, grafana, status, ansible — the hostnames declared in TunnelBindings under kustomize-cluster/workloads/

If the operator ever recreates the tunnel, the next tofu plan picks up the new ID via the data source and updates the CNAME content.

Test plan

• `tofu plan` shows 4 CNAMEs created, no other drift
• After apply: `curl -I https://argocd.makeitwork.cloud\` returns ArgoCD's login HTML (not Cloudflare 530)
• After grafana / ansible / status workloads come up (Phase B), their FQDNs resolve too

Pairs with

• The operator-managed tunnel naming was set in kustomize-cluster feat(forgejo): add forgejo.makeitwork.cloud CNAME #8 (cluster-apps-k3s).
• The previous tunnel cleanup is in tfroot-cloudflare chore(cf-tunnels): drop cluster_apps resource — operator owns it #3.

🤖 Generated with Claude Code

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cluster_apps["ansible"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "ansible"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["argocd"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "argocd"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["grafana"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "grafana"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_dns_record.cluster_apps["status"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "status"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

Plan: 4 to add, 0 to change, 0 to destroy.