feat: add cloudflare-tunnel chart for zero-trust ingress

[disentangle-network]

Summary

• Adds helm/cloudflare-tunnel/ chart deploying cloudflared for TLS ingress
• Eliminates need for cert-manager, ingress controller, and load balancer
• Single pod: ~100m CPU, ~128Mi RAM, 0 PVCs
• Requires Cloudflare Tunnel token stored as K8s Secret (external dependency)
• ARM64 compatible (official multi-arch image)

Architecture

Internet -> Cloudflare Edge (TLS) -> Tunnel -> cloudflared pod -> K8s Service

• No inbound ports required (tunnel is outbound-only)
• Cloudflare handles TLS termination via Universal SSL
• Ingress rules map hostnames to internal services

Chart Features

• Token from existing Secret or chart-created Secret
• Template validation: fails if neither tunnel.token nor tunnel.existingSecret is set
• Readiness probe on cloudflared health endpoint (:2000/ready)
• Hardened security contexts (runAsNonRoot, drop ALL, readOnlyRootFilesystem)
• CI: tunnel-lint job added to Helm CI workflow

Test plan

• helm lint helm/cloudflare-tunnel/ passes
• helm template with tunnel.token=test renders Deployment + Secret
• helm template with tunnel.existingSecret=my-secret renders Deployment only
• helm template with neither fails with clear error
• CI tunnel-lint job passes

Ref #16