feat(cloudflared): Cloudflare Tunnel connector, Phase 1 (isolated, no traffic change)

Adds platform/cloudflared: a locally-managed tunnel whose ingress rules live in
git. LAN/VPN-only hosts (plex, plex-vip, jackett, pihole, pihole-dns, semaphore,
qbittorrent, radarr, sonarr, headlamp, unifi, crafty-mc) map to 404. The apex
and *.home go to cilium-gateway-shared.gateway over TLS with matchSNItoHost.
Last comes a catch-all 404. Nothing routes to the Kubernetes API.

- 2-replica Deployment, hard node spread, non-root, pinned digest, PDB
- default-deny plus an egress CNP: Cloudflare edge 7844/443, the Gateway, and
  Gateway backends by gateway-access=shared minus the LAN-only namespaces
  (needed because of the CVE-2025-30162 L7LB egress re-check)
- PodMonitor plus two alerts that fire on absent series, with promtool tests
- its own Flux Kustomization (dependsOn platform-config, wait:false, nothing
  depends on it), plus SOPS decryption patches in both overlays
- placeholder credentials (SOPS-encrypted) so it can merge before enrolment
- L0 cloudflared-ingress-rules, and a cloudflared_ scrape owner
- runbooks/cloudflare-tunnel.md and decisions/2026-11-08-cloudflare-tunnel.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/namespace.yaml

@@ -0,0 +1,18 @@
+---
+# Cloudflare Tunnel connector (north-south INGRESS from the Cloudflare edge). See README.md.
+#
+# NOT homelab.keithjackson.dev/app-namespace=true. This is platform network infrastructure (like
+# vpn-ingress / vpn-egress), not an application, so Kyverno's app-scoped policies — including the
+# `require-default-deny-baseline` GENERATE rule — do not select this namespace. That is why
+# networkpolicy.yaml ships its own `default-deny` here, and why doing so creates NO second owner
+# of that object: Kyverno never generates one in a namespace without the app-namespace label
+# (the drift loop recorded in the 2026-09-30 handoff only exists where both write the same name).
+#
+# NO `gateway-access` label. Nothing here attaches an HTTPRoute to the shared Gateway; cloudflared
+# is a CLIENT of the Gateway, not a backend behind it.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflared
+  labels:
+    app.kubernetes.io/name: cloudflared