consolidate MetalLB IPs: 5 → 1 (10.0.20.200)

Migrate all 11 LoadBalancer services to share 10.0.20.200:
- Update annotations: metallb.universe.tf → metallb.io
- Pin all services to 10.0.20.200 with allow-shared-ip: shared
- Standardize externalTrafficPolicy to Cluster (required for IP sharing)
- Remove redundant port 80 (roundcube) from mailserver LB
- Update CoreDNS forward: 10.0.20.204 → 10.0.20.200
- Update cloudflared tunnel target: 10.0.20.202 → 10.0.20.200

Services consolidated: coturn, headscale, kms, qbittorrent, shadowsocks,
torrserver, wireguard, mailserver, traefik, xray, technitium

stacks/cloudflared/modules/cloudflared/cloudflare.tf

@@ -63,7 +63,7 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "sof" {
       content {
         hostname = ingress_rule.value == "viktorbarzin.me" ? ingress_rule.value : "${ingress_rule.value}.viktorbarzin.me"
         path     = "/"
-        service  = "https://10.0.20.202:443"
+        service  = "https://10.0.20.200:443"
         origin_request {
           no_tls_verify = true
         }