feat(cloudflared): wire tunnel token secret and document bootstrap

- Create SOPS-encrypted cloudflared-secrets.enc.yaml with tunnel token
- Add Cloudflare vars to .env.example (CLOUDFLARE_CONNECTOR_TOKEN, ACCOUNT_ID, TUNNEL_ID, API_TOKEN)
- Document Phase 0 cloudflared-token Secret creation in BOOTSTRAP.md (manual step until CMP plugin wires it)
- Note: Cloudflare-side TCP routing (cp1.homelab -> 192.168.1.213:6443, etc.) must be configured manually in Zero Trust dashboard

Tunnel already deployed as ArgoCD Application in k8s/argocd/apps/60-applications.yaml (wave 8); this closes the missing Secret gap and documents the bootstrap path.

k8s/argocd/bootstrap/BOOTSTRAP.md

@@ -66,7 +66,18 @@ argocd app sync forgejo
 git remote add forgejo http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
 git push forgejo main
 
-# 7. Deploy everything else from git — one sync brings up the whole cluster.
+# 7. (Optional) Cloudflared tunnel secret — if the SOPS CMP plugin is NOT yet
+#    wired up: create the cloudflared-token Secret manually before wave 8 syncs.
+#    Skip this step if the CMP plugin is already live and handling SOPS decryption.
+kubectl create namespace cloudflared --dry-run=client -o yaml | kubectl apply -f -
+sops -d k8s/applications/cloudflared/cloudflared-secrets.enc.yaml \
+  | yq '.cloudflared.tunnelToken' \
+  | kubectl create secret generic cloudflared-token -n cloudflared \
+      --from-literal=token=- --dry-run=client -o yaml | kubectl apply -f -
+# Once the SOPS CMP plugin is deployed (Phase 1 wave 0), migrate this Secret
+# into the plugin's script output and remove this manual step.
+
+# 8. Deploy everything else from git — one sync brings up the whole cluster.
 kubectl apply -f k8s/argocd/projects/homelab-project.yaml   # AppProject
 kubectl apply -k k8s/argocd/root                            # app-of-apps root
 argocd app sync homelab-root