consolidate MetalLB IPs: 5 → 1 (10.0.20.200)

Migrate all 11 LoadBalancer services to share 10.0.20.200:
- Update annotations: metallb.universe.tf → metallb.io
- Pin all services to 10.0.20.200 with allow-shared-ip: shared
- Standardize externalTrafficPolicy to Cluster (required for IP sharing)
- Remove redundant port 80 (roundcube) from mailserver LB
- Update CoreDNS forward: 10.0.20.204 → 10.0.20.200
- Update cloudflared tunnel target: 10.0.20.202 → 10.0.20.200

Services consolidated: coturn, headscale, kms, qbittorrent, shadowsocks,
torrserver, wireguard, mailserver, traefik, xray, technitium

stacks/mailserver/modules/mailserver/main.tf

@@ -460,15 +460,14 @@ resource "kubernetes_service" "mailserver" {
     }
 
     annotations = {
-      "metallb.universe.tf/allow-shared-ip" = "shared"
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
     }
   }
 
   spec {
-    type             = "LoadBalancer"
-    load_balancer_ip = "10.0.20.201"
-    # external_traffic_policy = "Cluster"
-    external_traffic_policy = "Local"
+    type = "LoadBalancer"
+    external_traffic_policy = "Cluster"
     selector = {
       app = "mailserver"
     }
@@ -500,12 +499,6 @@ resource "kubernetes_service" "mailserver" {
       port        = 993
       target_port = "imap-secure"
     }
-
-    port {
-      name     = "roundcube"
-      protocol = "TCP"
-      port     = 80
-    }
   }
 }