revert(cloudflared): do not publish the kube-apiserver at k8s.riotpiao.com

#88 added a tunnel rule mapping k8s.riotpiao.com to the in-cluster apiserver.
Its own comment warned that without a Cloudflare Access application in front,
every scanner on the internet reaches the apiserver, and no Access
application exists.

ArgoCD applied the rule before the exposure could be stopped, so the live
ConfigMap was patched and cloudflared restarted to drop it. All paths now
return 404. This commit removes the rule from the source so it cannot return.

The hostname keeps its DNS record and returns the tunnel's 404 fallback. That
is deliberate: publish it again only together with an Access policy.

k8s/apps/cloudflared/configmap.yaml

@@ -51,25 +51,4 @@ data:
       # even though the DNS CNAME points at the tunnel.
       - hostname: zitadel.riotpiao.com
         service: https://zitadel.riotpiao.com
-      # KUBERNETES API, for kubectl from outside the LAN.
-      #
-      # Origin is the in-cluster Service, not the node IP: that survives a
-      # control-plane address change and lets the connectors reach whichever
-      # apiserver is local-healthy.
-      #
-      # noTLSVerify is required. The apiserver serves a certificate for the
-      # cluster CA plus its node/LB addresses, so its SANs cannot match this
-      # public hostname. Cloudflare terminates the public TLS with the
-      # *.riotpiao.com edge certificate, and the connector hop is already
-      # inside the cluster, so skipping verification on that short hop is the
-      # least-bad option. Do not widen this to other rules.
-      #
-      # SECURITY: this exposes the API to the internet. Authentication is still
-      # ZITADEL OIDC plus client certificates, but put a Cloudflare Access
-      # application in front of this hostname as well -- see the note in the
-      # PR. Without Access, every scanner on the internet reaches the apiserver.
-      - hostname: k8s.riotpiao.com
-        service: https://kubernetes.default.svc.cluster.local:443
-        originRequest:
-          noTLSVerify: true
       - service: http_status:404