fix(external-dns): exclude internal records from Cloudflare, add opt-in filter, set targets

- external-dns-cloudflare: add excludeDomains: [local.mk-labs.cloud] to stop
  internal subdomain records from leaking to Cloudflare
- external-dns-cloudflare: replace hostname annotationFilter with opt-in model
  (external-dns.alpha.kubernetes.io/public=true) so only explicitly tagged
  services get public Cloudflare records
- external-dns-cloudflare: add extraArgs --target=lb.mk-labs.cloud
- external-dns (Technitium/rfc2136): add extraArgs
  --target=lightning-lane.local.mk-labs.cloud for internal records
- couchdb: add external-dns.alpha.kubernetes.io/public: 'true' annotation —
  first service to opt in to public DNS; will create communicore.mk-labs.cloud
  pointing to lb.mk-labs.cloud via Cloudflare ExternalDNS

URGENT: Cloudflare was creating records for local.mk-labs.cloud hosts.
Ryan: manually delete any *.local.mk-labs.cloud records currently in Cloudflare
(look for communicore.local.mk-labs.cloud and any other local.* entries).

cluster/applications/couchdb/values.yaml

@@ -61,6 +61,8 @@ ingress:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/hostname: "communicore.local.mk-labs.cloud"
     external-dns.alpha.kubernetes.io/target: "10.1.71.80"
+    # Opt in to public Cloudflare DNS — creates communicore.mk-labs.cloud -> lb.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/public: "true"
   hosts:
     - communicore.local.mk-labs.cloud
     - communicore.mk-labs.cloud