feat: route public DNS through Cloudflare Tunnel

[glitchedmob]

Routes public SGF Devs workloads directly to the HA k3s Cloudflare Tunnel connectors.

• Discovers the account-scoped tunnel by name and builds its DNS target.
• Routes the SGF Devs public site, Zitadel, and MethodConf records through the tunnel.
• Leaves platform administration, auth, Dex, SeaweedFS, and Hack4Good on their existing paths.

[github-actions]

Terraform plan

Artifacts: https://github.com/sgfdevs/infra-dns/actions/runs/33267904562

Show summary

CHANGE	RESOURCE
update (8)	module.methodconf_com.cloudflare_dns_record.core["apex"]
	module.methodconf_com.cloudflare_dns_record.core["cms"]
	module.methodconf_com.cloudflare_dns_record.core["cms_staging"]
	module.methodconf_com.cloudflare_dns_record.core["staging"]
	module.methodconf_com.cloudflare_dns_record.core["www"]
	module.sgf_dev.cloudflare_dns_record.core["apex"]
	module.sgf_dev.cloudflare_dns_record.core["id"]
	module.sgf_dev.cloudflare_dns_record.core["staging"]

Decrypt artifacts:
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.enc -out tfplan -pass pass:$OUTPUT_ENCRYPTION_KEY
openssl enc -d -aes-256-cbc -pbkdf2 -in tfplan.txt.enc -out tfplan.txt -pass pass:$OUTPUT_ENCRYPTION_KEY