feat(cloudflared): wire tunnel token secret and document bootstrap

- Create SOPS-encrypted cloudflared-secrets.enc.yaml with tunnel token
- Add Cloudflare vars to .env.example (CLOUDFLARE_CONNECTOR_TOKEN, ACCOUNT_ID, TUNNEL_ID, API_TOKEN)
- Document Phase 0 cloudflared-token Secret creation in BOOTSTRAP.md (manual step until CMP plugin wires it)
- Note: Cloudflare-side TCP routing (cp1.homelab -> 192.168.1.213:6443, etc.) must be configured manually in Zero Trust dashboard

Tunnel already deployed as ArgoCD Application in k8s/argocd/apps/60-applications.yaml (wave 8); this closes the missing Secret gap and documents the bootstrap path.

.env.example

@@ -68,3 +68,14 @@ AUTHENTIK_TEMPORAL_CLIENT_ID=
 # ── CI/CD ──────────────────────────────────────────────────────────────────────
 # Forgejo Personal Access Token (from rock user) for pushing images to registry
 FORGEJO_RIOTPIAO_PAT=
+
+# ── Cloudflare Tunnel (remote off-LAN access to kubectl/talosctl) ──────────────
+# From Cloudflare Zero Trust dashboard → Networks → Tunnels
+#   CLOUDFLARE_CONNECTOR_TOKEN: full tunnel token (JWT-like base64 string)
+#   CLOUDFLARE_ACCOUNT_ID: your account ID (hex string)
+#   CLOUDFLARE_TUNNEL_ID: tunnel UUID
+#   CLOUDFLARE_API_TOKEN: API token for programmatic tunnel config (optional)
+CLOUDFLARE_CONNECTOR_TOKEN=
+CLOUDFLARE_ACCOUNT_ID=
+CLOUDFLARE_TUNNEL_ID=
+CLOUDFLARE_API_TOKEN=