consolidate MetalLB IPs: 5 → 1 (10.0.20.200)

Migrate all 11 LoadBalancer services to share 10.0.20.200:
- Update annotations: metallb.universe.tf → metallb.io
- Pin all services to 10.0.20.200 with allow-shared-ip: shared
- Standardize externalTrafficPolicy to Cluster (required for IP sharing)
- Remove redundant port 80 (roundcube) from mailserver LB
- Update CoreDNS forward: 10.0.20.204 → 10.0.20.200
- Update cloudflared tunnel target: 10.0.20.202 → 10.0.20.200

Services consolidated: coturn, headscale, kms, qbittorrent, shadowsocks,
torrserver, wireguard, mailserver, traefik, xray, technitium

stacks/platform/modules/technitium/main.tf

@@ -74,7 +74,7 @@ resource "kubernetes_config_map" "coredns" {
           rcode NXDOMAIN
           fallthrough
         }
-        forward . 10.0.20.204 # Technitium LoadBalancer
+        forward . 10.0.20.200 # Technitium LoadBalancer
         cache {
           success 10000 300 6
           denial 10000 300 60
@@ -265,6 +265,10 @@ resource "kubernetes_service" "technitium-dns" {
     labels = {
       "app" = "technitium"
     }
+    annotations = {
+      "metallb.io/loadBalancerIPs" = "10.0.20.200"
+      "metallb.io/allow-shared-ip" = "shared"
+    }
   }
 
   spec {
@@ -274,7 +278,7 @@ resource "kubernetes_service" "technitium-dns" {
       port     = 53
       protocol = "UDP"
     }
-    external_traffic_policy = "Local"
+    external_traffic_policy = "Cluster"
     selector = {
       "dns-server" = "true"
     }