ADR-0016 (Proposed): public ingress via Cloudflare Tunnel

Record the operator's 2026-11-08 decision to move public HTTP(S) ingress
from edge port-forwarding of 80/443 to an outbound-only Cloudflare Tunnel
(in-cluster cloudflared, proxied CNAMEs via ExternalDNS). Motivation: the
GFiber router cannot hairpin NAT and advertises Google IPv6 DNS via RA, so
LAN clients bypass Pi-hole split horizon and fail.

Docs 00/01/03/07/08/09/13/14, GLOSSARY and definition-of-done brought into
line. R-DNS-01..03 and R-TLS-01..03 wording unchanged. New requirements:
R-DNS-04 (no 80/443 forward, resolver-independent LAN reachability),
R-DNS-05 (only `public` services at the tunnel; 404 catch-all; no public
record for `internal`), R-SEC-04 (Kubernetes API never publicly reachable).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/14-testing-and-conformance.md

@@ -82,6 +82,11 @@ Each maps to requirement IDs; phrased as Given/When/Then intent.
 - **DNS/exposure (R-DNS-*):** *Given* a service, *When* resolved, *Then* the record exists and
   internal clients hit the internal Gateway; `internal` is unreachable publicly, `public` is
   reachable + TLS-valid.
+- **Public ingress path (R-DNS-04/05, R-SEC-04):** *Given* the tunnel ingress config, *When* it is
+  rendered, *Then* every route is a `public` service, the last rule is `http_status:404`, and no rule
+  targets the Kubernetes API (L0). *When* a non-`public` hostname is requested at the tunnel, *Then*
+  it gets 404. *When* a `public` name is resolved via a public resolver from the LAN, *Then* it is
+  reachable + TLS-valid (L2).
 - **Hands-off update (R-UPD-01/02, L3):** *Given* an out-of-date service under a stable policy,
   *When* the scan interval elapses, *Then* it advances with no human/AI edit; *Given* a deliberately
   bad update, *Then* health-gating auto-rolls-back and an email alert fires; *Given* a pinned