feat(mcp): gate mcp.makeitwork.cloud behind Cloudflare Access

[xnoto]

Summary

Edge authentication for the new cluster MCP gateway (paired with makeitworkcloud/kustomize-cluster#62).

• cf-tunnels.tf — adds mcp to the cluster-apps CNAME list. This must be applied before the TunnelBinding lands in kustomize-cluster (documented DNS race, error 81053); the TunnelBinding PR follows this apply.
• cf-access-mcp.tf — dedicated mcp-gateway Access service token (duration = "forever", rotate via client_secret_version) + self_hosted application on mcp.makeitwork.cloud: non_identity service-token policy for headless agent clients (opencode, Claude Code, etc. send CF-Access-Client-* headers) and an admins GitHub-SSO policy for interactive debug.
• outputs.tf — exposes the service-token client_id and client_secret (sensitive) so agent clients can be configured after apply.

Scope change during review: the cf-access-opencode.tf gate was dropped — #25 deliberately removed the opencode Access gate because it breaks opencode attach; opencode web stays on the SOPS-managed server password. Re-gating needs an attach-compatible design first.

Validation

• tofu fmt ✅, tofu init -backend=false + tofu validate ✅
• make test ✅ (canonical pre-commit: validate, tflint, checkov, fmt, terraform-docs README regenerated)

Not run

• tofu plan / tofu apply — CI posts the plan here and applies on merge per the shared workflow.

Post-apply

1. tofu output mcp_gateway_service_token_client_id / tofu output -raw mcp_gateway_service_token_client_secret → local agent sessions as CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET (keyring/env only).
2. Then the follow-up TunnelBinding PR in kustomize-cluster is safe to merge.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cluster_apps["mcp"] will be created
  + resource "cloudflare_dns_record" "cluster_apps" {
      + content          = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
      + created_on       = (known after apply)
      + id               = (known after apply)
      + meta             = (known after apply)
      + modified_on      = (known after apply)
      + name             = "mcp"
      + proxiable        = (known after apply)
      + proxied          = true
      + settings         = (known after apply)
      + tags             = (known after apply)
      + tags_modified_on = (known after apply)
      + ttl              = 1
      + type             = "CNAME"
      + zone_id          = (sensitive value)
    }

  # cloudflare_zero_trust_access_application.mcp_gateway will be created
  + resource "cloudflare_zero_trust_access_application" "mcp_gateway" {
      + account_id                 = (sensitive value)
      + allowed_idps               = [
          + "e584ea47-1251-4939-95f4-4daf4a58cd31",
        ]
      + app_launcher_visible       = true
      + aud                        = (known after apply)
      + destinations               = (known after apply)
      + domain                     = "mcp.makeitwork.cloud"
      + http_only_cookie_attribute = true
      + id                         = (known after apply)
      + name                       = "MCP Gateway"
      + policies                   = [
          + {
              + decision   = "non_identity"
              + include    = [
                  + {
                      + service_token = {
                          + token_id = (known after apply)
                        }
                    },
                ]
              + name       = "mcp-gateway-clients"
              + precedence = 1
            },
          + {
              + decision   = "allow"
              + include    = [
                  + {
                      + group = {
                          + id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
                        }
                    },
                ]
              + name       = "makeitworkcloud-admins"
              + precedence = 2
            },
        ]
      + self_hosted_domains        = (known after apply)
      + session_duration           = "24h"
      + type                       = "self_hosted"
    }

  # cloudflare_zero_trust_access_service_token.mcp_gateway will be created
  + resource "cloudflare_zero_trust_access_service_token" "mcp_gateway" {
      + account_id            = (sensitive value)
      + client_id             = (known after apply)
      + client_secret         = (sensitive value)
      + client_secret_version = 1
      + duration              = "forever"
      + enabled               = (known after apply)
      + expires_at            = (known after apply)
      + id                    = (known after apply)
      + name                  = "mcp-gateway"
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + mcp_gateway_service_token_client_id     = (known after apply)
  + mcp_gateway_service_token_client_secret = (sensitive value)