feat(cloudflare): protect opencode hostname

[xnoto]

Summary

• declare opencode.makeitwork.cloud on the operator-owned cluster-apps-k3s tunnel
• protect the hostname with the existing GitHub-backed makeitworkcloud:admins Cloudflare Access group
• refresh generated OpenTofu resource documentation

Validation

• tofu fmt -check -recursive
• tofu init -backend=false -input=false
• tofu validate -no-color
• make test

Deployment order

Merge and apply this prerequisite before the dependent kustomize-cluster workload PR to prevent the TunnelBinding DNS ownership race. No live plan or apply was run locally.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cluster_apps["alertmanager"] will be updated in-place
  ~ resource "cloudflare_dns_record" "cluster_apps" {
      - comment             = "Managed by cloudflare-operator" -> null
      - comment_modified_on = "2026-08-25T22:29:02Z" -> null
        id                  = "92132bbb5cd95e2ee6a44a491cb188f5"
      ~ modified_on         = "2026-08-25T22:29:02Z" -> (known after apply)
        name                = "alertmanager.makeitwork.cloud"
        tags                = []
        # (9 unchanged attributes hidden)
    }

  # cloudflare_dns_record.cluster_apps["opencode"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "opencode"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_zero_trust_access_application.opencode will be created
  + resource "cloudflare_zero_trust_access_application" "opencode" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "opencode.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "OpenCode"
      + policies                   = [
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 1
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

Plan: 2 to add, 1 to change, 0 to destroy.