refactor(iam): retire terraform/zitadel, provision through the API

The Terraform root module duplicated a writer that the provisioning script could
be, and its state carried generated client secrets. Declare the objects in the
script instead: project, 19 roles, 12 OIDC apps, applied through the management
API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel.

Also add zitadel to the Cloudflare tunnel hostname list, with the import command
and the note that the tunnel's Public Hostname entry is a separate dashboard
step: DNS alone yields a 404 from the tunnel.

k8s/infra/iam/zitadel-values.yaml

@@ -36,7 +36,7 @@ zitadel:
     # `iam-admin` machine key all exist. Skip stops the setup hook from running
     # the first-instance step again. Without it, every sync re-runs the
     # machinekeyWriter, which silently rotates the iam-admin key Terraform
-    # reads and breaks the next `terraform apply` in terraform/zitadel.
+    # reads. ZITADEL objects are declared by scripts/iam/zitadel-provision.py.
     # Never set this back to false.
     FirstInstance:
       Skip: true