platform: add external-dns-cloudflare for public mk-labs.cloud zone

Deploy a second ExternalDNS instance targeting Cloudflare to manage
public DNS records in the mk-labs.cloud zone. The existing Technitium
(rfc2136) instance handling local.mk-labs.cloud is unchanged.

Components:
- application.yaml: ArgoCD Application, wave 6, namespace external-dns-cloudflare
- values.yaml: Cloudflare provider, domainFilters: mk-labs.cloud, txtOwnerId: fastpass
- externalsecret.yaml: ExternalSecret pulling CF_API_TOKEN from 1Password

PREREQUISITE (manual): Ryan must create the following in 1Password before
the ExternalSecret will sync:
  Item name:  cloudflare-external-dns
  Field name: api-token
  Value:      Cloudflare API token with DNS Edit on mk-labs.cloud

Until then, the ExternalSecret will show SecretSyncedError — expected.

cluster/platform/external-dns-cloudflare/application.yaml

@@ -0,0 +1,42 @@
+# ------------------------------------------------------------------------------
+# Platform: external-dns-cloudflare
+# Wave 6 — same wave as existing external-dns (Technitium)
+# Multi-source: Helm chart from upstream + ExternalSecret from repo
+#
+# PREREQUISITE: 1Password item "cloudflare-external-dns" with field "api-token"
+# must exist before the ExternalSecret can sync and ExternalDNS can start.
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns-cloudflare
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "6"
+spec:
+  project: default
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://kubernetes-sigs.github.io/external-dns
+      chart: external-dns
+      targetRevision: 1.15.1
+      helm:
+        valueFiles:
+          - $values/cluster/platform/external-dns-cloudflare/values.yaml
+    # Source 2: Repo — values ref + ExternalSecret manifest
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/external-dns-cloudflare
+      ref: values
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-dns-cloudflare
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true