[ci skip] Enable HTTP/3 (QUIC) for all ingresses

- Add http3.enabled + advertisedPort=443 to Traefik websecure entrypoint
- Add cloudflare_zone_settings_override to enable HTTP/3 for proxied domains

modules/kubernetes/cloudflared/cloudflare.tf

@@ -148,3 +148,12 @@ resource "cloudflare_record" "keyserver" {
   priority = 1
   zone_id  = var.cloudflare_zone_id
 }
+
+# Enable HTTP/3 (QUIC) for Cloudflare-proxied domains
+resource "cloudflare_zone_settings_override" "http3" {
+  zone_id = var.cloudflare_zone_id
+
+  settings {
+    http3 = "on"
+  }
+}

modules/kubernetes/traefik/main.tf

@@ -87,7 +87,8 @@ resource "helm_release" "traefik" {
           }
         }
         http3 = {
-          enabled = true
+          enabled        = true
+          advertisedPort = 443
         }
       }
       dns-udp = {