Resolve OQ-4: scoped Cloudflare API token for DNS-01 + ExternalDNS

Operator chose Option A. cert-manager solves ACME DNS-01 and ExternalDNS
manages *.home.keithjackson.dev records via a scoped Cloudflare token
(Zone.DNS.Edit, keithjackson.dev), stored SOPS-encrypted. Operator provides
the token once (new prereq T-2.4p); T-2.4/T-2.5 unblocked. Only OQ-BKP
(off-cluster DR backup target, Phase 4) remains open.

Updated: docs 00,08,09; task board.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/00-vision-and-scope.md

@@ -195,10 +195,13 @@ implementation.
   tunnel**, **non-TCP** (OpenVPN UDP / Lightway-UDP), rules enforced outside the service
   (ADR-0012). See [`03`](03-networking-isolation-and-egress.md).
 
+- **OQ-4 (TLS/DNS challenge access)** — **RESOLVED**: a **scoped Cloudflare API token**
+  (`Zone·DNS·Edit`, `keithjackson.dev`), SOPS-encrypted, drives cert-manager DNS-01 and ExternalDNS.
+  The static `*.keithjackson.dev` wildcard covers reachability but not TXT-challenge writes; the token
+  handles issuance + record automation. Operator provides the token once. See
+  [`08`](08-tls-and-certificates.md).
+
 ### Still open
-- **OQ-4 (TLS/DNS challenge access)**: Cloudflare already has a wildcard `*.keithjackson.dev` → public
-  IP (covers reachability), but **ACME DNS-01 needs write access** to create `_acme-challenge` TXT
-  records, and `*.keithjackson.dev` does **not** match the two-label-deep `*.home.keithjackson.dev`.
-  Decide the challenge mechanism: **(a)** a scoped Cloudflare **API token** (Zone·DNS·Edit) → fully
-  automated DNS-01 + ExternalDNS, or **(b)** **acme-dns delegation** (one-time `_acme-challenge`
-  CNAME edit, then no standing Cloudflare credential). See [`08`](08-tls-and-certificates.md).
+- **OQ-BKP (off-cluster DR backup target)**: which S3-compatible endpoint or NFS host stores
+  Velero/Longhorn backups of the irreplaceable tier. Needed by **Phase 4**, not blocking Phase 2.
+  See [`04`](04-storage-and-state.md).