cloudflared: move bridge removed{} to stack root — removed blocks are root-module-only

Pipeline 461 failed terraform init: the removed{} handoff block sat in
the stack-local module, but Terraform only allows removed blocks in the
root module. Same intent, correct position (from =
module.cloudflared.cloudflare_record.bridge_pages, destroy=false).
Without this the stale state entry would make the next cloudflared
apply destroy the record valia-sites now owns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/cloudflared/modules/cloudflared/cloudflare.tf

@@ -236,16 +236,9 @@ resource "cloudflare_record" "keyserver" {
 }
 
 # bridge.viktorbarzin.me (Cloudflare Pages, "мост" school site) moved to
-# stacks/valia-sites (ADR-0018) — all Valia-site records live there now.
-# Forget from this state WITHOUT destroying; valia-sites imports the live
-# record by id. Delete this block once both stacks have applied.
-removed {
-  from = cloudflare_record.bridge_pages
-
-  lifecycle {
-    destroy = false
-  }
-}
+# stacks/valia-sites (ADR-0018) — all Valia-site records live there now. The
+# state forget lives in the STACK ROOT (../..//removed-bridge.tf): removed{}
+# blocks are root-module-only.
 
 # Enable HTTP/3 (QUIC) for Cloudflare-proxied domains
 resource "cloudflare_zone_settings_override" "http3" {

stacks/cloudflared/removed-bridge.tf

@@ -0,0 +1,12 @@
+# bridge.viktorbarzin.me (Cloudflare Pages) moved to stacks/valia-sites
+# (ADR-0018), which has already imported the live record. Forget it from this
+# stack's state WITHOUT destroying. removed{} must sit in the root module —
+# a module-level attempt broke init (pipeline 461). Delete this file once the
+# apply has run.
+removed {
+  from = module.cloudflared.cloudflare_record.bridge_pages
+
+  lifecycle {
+    destroy = false
+  }
+}