refactor(edge,iam): apply best practices to relay and Zitadel config

- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables
- edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers
- edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs
- edge: mark user_data sensitive and add prevent_destroy to the relay instance
- edge: validate relay_admin_cidr and Cloudflare hostnames
- edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs
- iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes
- iam: keep login hardened; drop unsupported login PDB

terraform/edge/cloudflare.tf

@@ -18,9 +18,18 @@ resource "cloudflare_dns_record" "tunnel" {
   name    = each.value
   type    = "CNAME"
   content = local.tunnel_target
-  proxied = true
-  ttl     = 1 # 1 = automatic, required when proxied is true
+  proxied = var.cloudflare_dns_proxied
+  ttl     = var.cloudflare_dns_ttl
   comment = "cloudflared tunnel; managed by terraform/edge"
+
+  # A proxied CNAME must point at the tunnel target. A CNAME to any other
+  # hostname breaks the tunnel mapping.
+  lifecycle {
+    precondition {
+      condition     = var.cloudflare_dns_proxied
+      error_message = "Tunnel CNAMEs must be proxied; an unproxied record bypasses the tunnel."
+    }
+  }
 }
 
 # Optional: take the tunnel configuration into Terraform. Off by default.