Tunnel

This draft turns a noisy environment-specific note into a cleaner pattern: create the Cloudflare Tunnel credentials, store them as Kubernetes secrets, define a cloudflared config map, run the deployment, and validate that the tunnel actually maps the hostname to the intended TCP service.