ADR-0016 (Proposed): public ingress via Cloudflare Tunnel

Record the operator's 2026-11-08 decision to move public HTTP(S) ingress
from edge port-forwarding of 80/443 to an outbound-only Cloudflare Tunnel
(in-cluster cloudflared, proxied CNAMEs via ExternalDNS). Motivation: the
GFiber router cannot hairpin NAT and advertises Google IPv6 DNS via RA, so
LAN clients bypass Pi-hole split horizon and fail.

Docs 00/01/03/07/08/09/13/14, GLOSSARY and definition-of-done brought into
line. R-DNS-01..03 and R-TLS-01..03 wording unchanged. New requirements:
R-DNS-04 (no 80/443 forward, resolver-independent LAN reachability),
R-DNS-05 (only `public` services at the tunnel; 404 catch-all; no public
record for `internal`), R-SEC-04 (Kubernetes API never publicly reachable).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/definition-of-done.md

@@ -53,7 +53,10 @@ screenshot, or "it reconciles" is **not** done (R-TEST-01..04, [`../docs/14-test
 ### DNS & ingress (R-DNS-*)
 - [ ] `<service>.home.keithjackson.dev` record appears automatically and routes correctly.
 - [ ] `internal` is unreachable publicly; `public` is reachable + TLS-valid.
-- [ ] Internal clients resolve to the internal Gateway (no public hairpin).
+- [ ] Internal clients resolving via Pi-hole reach the internal Gateway; via a public resolver, a
+      `public` service still works through the tunnel (R-DNS-04).
+- [ ] Non-`public` hostnames get 404 at the tunnel and have no public record (R-DNS-05); the
+      Kubernetes API is not publicly reachable (R-SEC-04).
 
 ### Automated updates (R-UPD-*)
 - [ ] Advances to a newer **stable** version automatically on schedule with **no human/AI edit**.