feat(terraform): add per-node Cloudflare Tunnel cert SANs to controlplane certSANs — remote talosctl/kubectl over tunnel pass TLS verification

Adds optional cloudflare_talos_sans (machine.certSANs, talos API :50000) and
cloudflare_apiserver_sans (cluster.apiServer.certSANs, kube-apiserver :6443) per
control-plane node. cp-1 gets cp1.homelab + cp1-talos.homelab; cp-2/cp-3 get
their cpN-talos.homelab. Values set in gitignored tfvars.

terraform/variables.tf

@@ -130,6 +130,10 @@ variable "controlplane_configs" {
     }))
     zone             = string
     allow_scheduling = bool
+    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
+    # remote talosctl/kubectl over the tunnel pass TLS verification.
+    cloudflare_talos_sans     = optional(list(string), [])
+    cloudflare_apiserver_sans = optional(list(string), [])
   }))
   description = "Control plane machine configurations, keyed by node"
 }