refactor(iam): retire terraform/zitadel, provision through the API

The Terraform root module duplicated a writer that the provisioning script could
be, and its state carried generated client secrets. Declare the objects in the
script instead: project, 19 roles, 12 OIDC apps, applied through the management
API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel.

Also add zitadel to the Cloudflare tunnel hostname list, with the import command
and the note that the tunnel's Public Hostname entry is a separate dashboard
step: DNS alone yields a 404 from the tunnel.

terraform/edge/terraform.tfvars.example

@@ -8,8 +8,15 @@ cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
 tunnel_id          = "REPLACE_WITH_TUNNEL_UUID"
 
 # Adopt existing records with `terraform import` before the first apply, or the
-# create call collides with the hand-made record of the same name.
-cloudflare_tunnel_hostnames = ["paperless", "img", "poimen"]
+# create call collides with the hand-made record of the same name:
+#   terraform import 'cloudflare_dns_record.tunnel["zitadel"]' \
+#     <zone_id>/<record_id>
+#
+# A tunnel CNAME is only half of the path. The tunnel's Public Hostname list
+# (Zero Trust -> Networks -> Tunnels -> Public Hostname) must also map the name
+# to https://<name>.riotpiao.com, or Cloudflare answers 404 from the tunnel even
+# though DNS resolves.
+cloudflare_tunnel_hostnames = ["paperless", "img", "poimen", "zitadel"]
 
 # Leave false until the tunnel config import is understood. True makes
 # Terraform replace the entire ingress list with tunnel_ingress.