[infra] Auto-create Cloudflare DNS records from ingress_factory

## Context

Deploying new services required manually adding hostnames to
cloudflare_proxied_names/cloudflare_non_proxied_names in config.tfvars —
a separate file from the service stack. This was frequently forgotten,
leaving services unreachable externally.

## This change:

- Add `dns_type` parameter to `ingress_factory` and `reverse_proxy/factory`
  modules. Setting `dns_type = "proxied"` or `"non-proxied"` auto-creates
  the Cloudflare DNS record (CNAME to tunnel or A/AAAA to public IP).
- Simplify cloudflared tunnel from 100 per-hostname rules to wildcard
  `*.viktorbarzin.me → Traefik`. Traefik still handles host-based routing.
- Add global Cloudflare provider via terragrunt.hcl (separate
  cloudflare_provider.tf with Vault-sourced API key).
- Migrate 118 hostnames from centralized config.tfvars to per-service
  dns_type. 17 hostnames remain centrally managed (Helm ingresses,
  special cases).
- Update docs, AGENTS.md, CLAUDE.md, dns.md runbook.

```
BEFORE                          AFTER
config.tfvars (manual list)     stacks/<svc>/main.tf
        |                         module "ingress" {
        v                           dns_type = "proxied"
stacks/cloudflared/               }
  for_each = list                     |
  cloudflare_record               auto-creates
  tunnel per-hostname             cloudflare_record + annotation
```

## What is NOT in this change:

- Uptime Kuma monitor migration (still reads from config.tfvars)
- 17 remaining centrally-managed hostnames (Helm, special cases)
- Removal of allow_overwrite (keep until migration confirmed stable)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/kubernetes/ingress_factory/main.tf

@@ -1,3 +1,14 @@
+terraform {
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+  }
+}
 
 variable "name" { type = string }
 variable "service_name" {
@@ -76,6 +87,38 @@ variable "anti_ai_scraping" {
   default = null # null = auto (enabled when not protected, disabled when protected)
 }
 
+variable "dns_type" {
+  type        = string
+  default     = "none"
+  description = "Cloudflare DNS: 'proxied' (CNAME to tunnel), 'non-proxied' (A/AAAA to public IP), or 'none'"
+  validation {
+    condition     = contains(["proxied", "non-proxied", "none"], var.dns_type)
+    error_message = "dns_type must be 'proxied', 'non-proxied', or 'none'."
+  }
+}
+
+# Cloudflare config defaults — override via variables if these change.
+# Source of truth: config.tfvars (cloudflare_zone_id, cloudflare_tunnel_id, public_ip, public_ipv6)
+variable "cloudflare_zone_id" {
+  type    = string
+  default = "fd2c5dd4efe8fe38958944e74d0ced6d"
+}
+
+variable "cloudflare_tunnel_id" {
+  type    = string
+  default = "75182cd7-bb91-4310-b961-5d8967da8b41"
+}
+
+variable "public_ip" {
+  type    = string
+  default = "176.12.22.76"
+}
+
+variable "public_ipv6" {
+  type    = string
+  default = "2001:470:6e:43d::2"
+}
+
 variable "homepage_group" {
   type    = string
   default = null # auto-detect from namespace
@@ -122,6 +165,8 @@ locals {
     lookup(local.ns_to_group, var.namespace, "Other")
   )
 
+  dns_name = local.effective_host == var.root_domain ? "@" : replace(local.effective_host, ".${var.root_domain}", "")
+
   homepage_defaults = var.homepage_enabled ? {
     "gethomepage.dev/enabled" = "true"
     "gethomepage.dev/name"    = replace(replace(var.name, "-", " "), "_", " ")
@@ -177,7 +222,9 @@ resource "kubernetes_ingress_v1" "proxied-ingress" {
         var.custom_content_security_policy != null ? "${var.namespace}-custom-csp-${var.name}@kubernetescrd" : null,
       ], var.extra_middlewares)))
       "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
-    }, local.homepage_defaults, var.extra_annotations)
+    }, local.homepage_defaults, var.extra_annotations,
+      var.dns_type != "none" ? { "cloudflare.viktorbarzin.me/dns-type" = var.dns_type } : {}
+    )
   }
 
   spec {
@@ -255,3 +302,38 @@ resource "kubernetes_manifest" "custom_csp" {
     }
   }
 }
+
+# Cloudflare DNS records — created automatically when dns_type is set.
+# Proxied: CNAME to Cloudflare tunnel. Non-proxied: A + AAAA to public IP.
+resource "cloudflare_record" "proxied" {
+  count           = var.dns_type == "proxied" ? 1 : 0
+  name            = local.dns_name
+  content         = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied         = true
+  ttl             = 1
+  type            = "CNAME"
+  zone_id         = var.cloudflare_zone_id
+  allow_overwrite = true
+}
+
+resource "cloudflare_record" "non_proxied_a" {
+  count           = var.dns_type == "non-proxied" ? 1 : 0
+  name            = local.dns_name
+  content         = var.public_ip
+  proxied         = false
+  ttl             = 1
+  type            = "A"
+  zone_id         = var.cloudflare_zone_id
+  allow_overwrite = true
+}
+
+resource "cloudflare_record" "non_proxied_aaaa" {
+  count           = var.dns_type == "non-proxied" ? 1 : 0
+  name            = local.dns_name
+  content         = var.public_ipv6
+  proxied         = false
+  ttl             = 1
+  type            = "AAAA"
+  zone_id         = var.cloudflare_zone_id
+  allow_overwrite = true
+}