feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification

Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.

terraform/templates/controlplane.tftpl

@@ -13,6 +13,9 @@ machine:
 %{ if wg0_ip != null ~}
     - ${wg0_ip}
 %{ endif ~}
+%{ for san in cloudflare_talos_sans ~}
+    - ${san}
+%{ endfor ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -145,6 +148,9 @@ cluster:
       - ${wg0_ip}
 %{ endif ~}
       - ${lan_ip}
+%{ for san in cloudflare_apiserver_sans ~}
+      - ${san}
+%{ endfor ~}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity