platform: add external-dns-cloudflare for public mk-labs.cloud zone

Deploy a second ExternalDNS instance targeting Cloudflare to manage
public DNS records in the mk-labs.cloud zone. The existing Technitium
(rfc2136) instance handling local.mk-labs.cloud is unchanged.

Components:
- application.yaml: ArgoCD Application, wave 6, namespace external-dns-cloudflare
- values.yaml: Cloudflare provider, domainFilters: mk-labs.cloud, txtOwnerId: fastpass
- externalsecret.yaml: ExternalSecret pulling CF_API_TOKEN from 1Password

PREREQUISITE (manual): Ryan must create the following in 1Password before
the ExternalSecret will sync:
  Item name:  cloudflare-external-dns
  Field name: api-token
  Value:      Cloudflare API token with DNS Edit on mk-labs.cloud

Until then, the ExternalSecret will show SecretSyncedError — expected.

cluster/platform/external-dns-cloudflare/externalsecret.yaml

@@ -0,0 +1,32 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Cloudflare API Token
+# Pulled from 1Password, materialized in the external-dns-cloudflare namespace.
+#
+# PREREQUISITE: Ryan must create the following 1Password item before ArgoCD
+# can sync this secret successfully:
+#   - Item name:  cloudflare-external-dns
+#   - Field name: api-token
+#   - Value:      A Cloudflare API token scoped to DNS Edit on mk-labs.cloud
+#
+# Until that item exists, the ExternalSecret will report SecretSyncedError —
+# this is expected and acceptable. The ExternalDNS pod will fail to start
+# until the secret is available.
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: external-dns-cloudflare
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: cloudflare-api-token
+    creationPolicy: Owner
+  data:
+    - secretKey: cloudflare_api_token
+      remoteRef:
+        key: cloudflare-external-dns   # 1Password item name
+        property: api-token            # 1Password field name