[ci skip] Add tier labels to all namespace resources for Kyverno resource governance

Added `tier = var.tier` to kubernetes_namespace labels in ~73 service
modules. This enables Kyverno to generate LimitRange defaults,
ResourceQuotas, and PriorityClass injection for all namespaces.

Previously only 11 namespaces had tier labels; now all 80 active
namespaces are labeled. All pods restarted in rolling waves to pick
up the new policies.

modules/kubernetes/cloudflared/main.tf

@@ -5,6 +5,9 @@ variable "cloudflare_tunnel_token" {}
 resource "kubernetes_namespace" "cloudflared" {
   metadata {
     name = "cloudflared"
+    labels = {
+      tier = var.tier
+    }
   }
 }
 variable "tier" { type = string }