chore(comfyui): retire the app for good

comfyui served nothing and its oauth2-proxy could not start: the Secret
carried only client-secret while the Deployment asked for client-id,
cookie-secret and client-secret. Rather than repair a service nobody used,
remove it from every layer.

Gone:
  - k8s/apps/comfyui/* and its ArgoCD Application
  - the cloudflared tunnel rule for comfyui.riotpiao.com
  - the CoreDNS rewrite in the terraform Corefile (the tracked source)
  - the Cloudflare DNS record (terraform tfvars)
  - the ZITADEL OIDC app and its two rotation tables
  - the KeyRotation object

Not gone by this commit: the comfyui namespace and its 50Gi PVC. ArgoCD does
not own either, so a person deletes both by hand after the prune. The local
cluster-config/talos-*.yaml copies are gitignored; they carry the same
removal and need an apply-config to reach the live CoreDNS.

k8s/apps/key-rotation-controller/README.md

@@ -40,7 +40,7 @@ target is one root-of-trust file per thing that cannot rotate itself:
 | controller bootstrap key | chicken and egg: it creates every other key |
 | etcd defrag credentials | needed by a job that runs outside the controller |
 
-Everything else — Grafana, Argo CD, Forgejo, MinIO, Paperless, Immich, ComfyUI,
+Everything else — Grafana, Argo CD, Forgejo, MinIO, Paperless, Immich,
 api-gw, Gotify — is a KeyRotation object, and its secret leaves git.
 
 ## Status