fix: add reflector annotations for cloudflare secret replication to cert-manager

- Fix ClusterIssuer apiTokenSecretRef key to CF_API_TOKEN
- Add reflector annotations to cloudflare-token SealedSecret for auto-reflection to cert-manager namespace

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: justgithubaccount

platform/infrastructure/networking/cert-manager/base/issuer-cluster.yaml

@@ -15,4 +15,4 @@ spec:
           cloudflare:
             apiTokenSecretRef:
               name: cloudflare-token
-              key: CLOUDFLARE_TOKEN
+              key: CF_API_TOKEN

platform/infrastructure/networking/external-dns/base/cloudflare-secrets.yaml

@@ -13,3 +13,8 @@ spec:
     metadata:
       name: cloudflare-token
       namespace: external-dns
+      annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+        reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cert-manager"
+        reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+        reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cert-manager"