fix(cloudflare): remove OpenCode Access gate

[xnoto]

Summary

• remove the Cloudflare Access application that prevents native opencode attach from reaching the OpenCode server
• retain the proxied Tunnel CNAME; authentication is now enforced by the server via the SOPS-encrypted password

Validation

• make test

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_zero_trust_access_application.opencode will be destroyed
  # (because cloudflare_zero_trust_access_application.opencode is not in configuration)
  - resource "cloudflare_zero_trust_access_application" "opencode" {
      - account_id                 = (sensitive value) -> null
      - allowed_idps               = [
          - "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ] -> null
      - app_launcher_visible       = true -> null
      - aud                        = "e06d181b827240bd60d422b762d292bf4e0ea00c6a001e50a8938ec7fda0ba63" -> null
      - destinations               = [
          - {
              - type = "public" -> null
              - uri  = "opencode.makeitwork.cloud" -> null
            },
        ] -> null
      - domain                     = "opencode.makeitwork.cloud" -> null
      - http_only_cookie_attribute = true -> null
      - id                         = "d444f7bc-6679-4ff8-b692-f01e5c4a56d3" -> null
      - name                       = "OpenCode" -> null
      - policies                   = [
          - {
              - decision   = "allow" -> null
              - include    = [
                  - {
                      - group = {
                          - id = "e0d9e873-31d7-4536-9234-3dad8a99d84d" -> null
                        } -> null
                    },
                ] -> null
              - name       = "makeitworkcloud-admins" -> null
              - precedence = 1 -> null
            },
        ] -> null
      - self_hosted_domains        = [
          - "opencode.makeitwork.cloud",
        ] -> null
      - session_duration           = "24h" -> null
      - type                       = "self_hosted" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.