feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification

Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.

terraform/main.tf

@@ -51,6 +51,10 @@ resource "local_file" "controlplane_configs" {
     zone                = each.value.zone
     allow_scheduling    = each.value.allow_scheduling
 
+    # Cloudflare Tunnel cert SANs (talos :50000 and kube-apiserver :6443)
+    cloudflare_talos_sans     = each.value.cloudflare_talos_sans
+    cloudflare_apiserver_sans = each.value.cloudflare_apiserver_sans
+
     # Cluster config
     cluster_id      = var.cluster_id
     cluster_secret  = var.cluster_secret