refactor(iam): retire terraform/zitadel, provision through the API

The Terraform root module duplicated a writer that the provisioning script could
be, and its state carried generated client secrets. Declare the objects in the
script instead: project, 19 roles, 12 OIDC apps, applied through the management
API with the iam-admin PAT. State is a 0600 JSON file under ~/.config/zitadel.

Also add zitadel to the Cloudflare tunnel hostname list, with the import command
and the note that the tunnel's Public Hostname entry is a separate dashboard
step: DNS alone yields a 404 from the tunnel.

terraform/zitadel/api_apps.tf

@@ -1,18 +0,0 @@
-# API applications — the machine-token surface.
-#
-# ZITADEL keeps two different objects apart: an OIDC application is for a
-# browser flow, and an API application is what a client_credentials / JWT-profile
-# caller presents. Authentik modelled both with one provider, so the plan §1.1
-# row 1 ("OIDC app + machine user") needs one of each here.
-#
-# The gateway signs its token request with the machine key from machines.tf, so
-# the auth method is PRIVATE_KEY_JWT. No secret is stored for it.
-
-resource "zitadel_application_api" "machine" {
-  for_each = { for name, spec in local.machine_users : name => spec if contains(keys(var.api_app_consumers), name) }
-
-  org_id           = data.zitadel_org.default.id
-  project_id       = zitadel_project_v2.homelab.id
-  name             = "${each.key}-machine"
-  auth_method_type = "API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT"
-}