feat(cloudflared): manage tunnel ingress locally via ConfigMap

The tunnel was remotely managed from the Zero Trust dashboard: the
Deployment ran 'run --token' and ignored the ConfigMap that already
existed in the tree. Switch to a locally-managed tunnel so the ingress
routing table lives in git.

- deployment: mount cloudflared-config (config.yml) and the
  cloudflared-credentials Secret; drop TUNNEL_TOKEN env
- configmap.yaml: per-hostname ingress rules to ingress-nginx via the
  CoreDNS rewrite, plus a 404 catch-all
- secret-generator: register the SOPS-encrypted credentials file
- homelab-ca: add the cloudflared namespace copy so the connector trusts
  the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and
re-encrypted with SOPS; no plaintext secret is committed.

k8s/apps/cloudflared/deployment.yaml

@@ -13,23 +13,63 @@ spec:
       labels:
         app: cloudflared
     spec:
+      # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
+      # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
+      # with "certificate signed by unknown authority". Same pattern as
+      # authentik-values.yaml: merge the system bundle with homelab-ca.crt.
+      initContainers:
+        - name: merge-ca-certs
+          image: debian:bookworm
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          command:
+            - sh
+            - -c
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
+          volumeMounts:
+            - name: homelab-ca
+              mountPath: /homelab-ca
+              readOnly: true
+            - name: merged-ca
+              mountPath: /merged
+      volumes:
+        - name: config
+          configMap:
+            name: cloudflared-config
+        - name: credentials
+          secret:
+            secretName: cloudflared-credentials
+        - name: homelab-ca
+          configMap:
+            name: homelab-ca
+        - name: merged-ca
+          emptyDir: {}
       containers:
         - name: cloudflared
           image: cloudflare/cloudflared:latest
           args:
             - tunnel
             - --no-autoupdate
-            - run
             - --protocol
             - http2
-            - --token
-            - $(TUNNEL_TOKEN)
+            - --config
+            - /etc/cloudflared/config.yml
+            - run
           env:
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: cloudflared-token
-                  key: token
+            - name: SSL_CERT_FILE
+              value: /merged/ca-bundle.crt
+          volumeMounts:
+            - name: config
+              mountPath: /etc/cloudflared/config.yml
+              subPath: config.yml
+              readOnly: true
+            - name: credentials
+              mountPath: /etc/cloudflared/creds
+              readOnly: true
+            - name: merged-ca
+              mountPath: /merged
+              readOnly: true
           resources:
             requests:
               cpu: 10m