feat(cloudflared): wire tunnel token secret and document bootstrap

- Create SOPS-encrypted cloudflared-secrets.enc.yaml with tunnel token
- Add Cloudflare vars to .env.example (CLOUDFLARE_CONNECTOR_TOKEN, ACCOUNT_ID, TUNNEL_ID, API_TOKEN)
- Document Phase 0 cloudflared-token Secret creation in BOOTSTRAP.md (manual step until CMP plugin wires it)
- Note: Cloudflare-side TCP routing (cp1.homelab -> 192.168.1.213:6443, etc.) must be configured manually in Zero Trust dashboard

Tunnel already deployed as ArgoCD Application in k8s/argocd/apps/60-applications.yaml (wave 8); this closes the missing Secret gap and documents the bootstrap path.

k8s/applications/cloudflared/cloudflared-secrets.enc.yaml

@@ -0,0 +1,17 @@
+cloudflared:
+    tunnelToken: ENC[AES256_GCM,data:GrZNC75M1T304m+MBbgcL9Wa6VD3Cc+joERjUWD7PsI5NlqFpVuorzub4OTaiE/F0sqDXtXdSwQP9jGTkgUnNbviUVEIBDb+zuiyzCfzuhc53oMvoUYRkRNeH5DR9TBEszspj8+mjQMDAKQFKtTmyDodgh8DdPg8LE8YTCqyx6CcpkGZ8yWY06VoKpZfFSOan/gHwRwG2500P8U+rzI676EKVUhWjBFP0iTbwDQR7spI7oz8Gon/0Q==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:/T63FivzvbLFaXEaBsn5FA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpU2tjOGpJNk9leE9LSnlx
+            b2tVbFFMMkZ3OHZuU0VhcUp5Tjl4ZDh2R1U4CjFFMURDWFJtN1lETUNpSmEwbU9u
+            aEIxUW5qWTJGTnlobjV0emlpY00rM28KLS0tIFd0cllZeXFodFhJNTJMNkRLNyt1
+            cXVyNnM4Y2pXeUFTYzU1OXlaOXR2RWcKp7/M/YFfpJg4L6a0AcYTV3Rza+bzaOeD
+            OUIwyns8ZsPtU8ILbRYUUdD2EJFiOPnWP4yX70Ak10v12gfB7vRJ6A==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-20T17:49:35Z"
+    mac: ENC[AES256_GCM,data:MhuuuInJjGbzoftxVqMZUov1tJpOt5Vb8GwTr0R12hRCVHwdV+cuC1YeXTQidYaduO7neGnYe0p8ESLEpyY06j4nSpCvGRPPaxTeSeA8IcIk71xNtA1X0FVPv51s59rpvVSjiMDCqrcOv1aJybfQnBZoc/9bfmCYGqhDkD6sg1U=,iv:ThTjUGYE9GiyIgXS+0KDLYS20RPJjMG9DKyMSoKGk/4=,tag:KqZYps5qSuKPUI4U3Iabmw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/argocd/bootstrap/BOOTSTRAP.md

@@ -66,7 +66,18 @@ argocd app sync forgejo
 git remote add forgejo http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
 git push forgejo main
 
-# 7. Deploy everything else from git — one sync brings up the whole cluster.
+# 7. (Optional) Cloudflared tunnel secret — if the SOPS CMP plugin is NOT yet
+#    wired up: create the cloudflared-token Secret manually before wave 8 syncs.
+#    Skip this step if the CMP plugin is already live and handling SOPS decryption.
+kubectl create namespace cloudflared --dry-run=client -o yaml | kubectl apply -f -
+sops -d k8s/applications/cloudflared/cloudflared-secrets.enc.yaml \
+  | yq '.cloudflared.tunnelToken' \
+  | kubectl create secret generic cloudflared-token -n cloudflared \
+      --from-literal=token=- --dry-run=client -o yaml | kubectl apply -f -
+# Once the SOPS CMP plugin is deployed (Phase 1 wave 0), migrate this Secret
+# into the plugin's script output and remove this manual step.
+
+# 8. Deploy everything else from git — one sync brings up the whole cluster.
 kubectl apply -f k8s/argocd/projects/homelab-project.yaml   # AppProject
 kubectl apply -k k8s/argocd/root                            # app-of-apps root
 argocd app sync homelab-root