platform: add external-dns-cloudflare for public mk-labs.cloud zone

Deploy a second ExternalDNS instance targeting Cloudflare to manage
public DNS records in the mk-labs.cloud zone. The existing Technitium
(rfc2136) instance handling local.mk-labs.cloud is unchanged.

Components:
- application.yaml: ArgoCD Application, wave 6, namespace external-dns-cloudflare
- values.yaml: Cloudflare provider, domainFilters: mk-labs.cloud, txtOwnerId: fastpass
- externalsecret.yaml: ExternalSecret pulling CF_API_TOKEN from 1Password

PREREQUISITE (manual): Ryan must create the following in 1Password before
the ExternalSecret will sync:
  Item name:  cloudflare-external-dns
  Field name: api-token
  Value:      Cloudflare API token with DNS Edit on mk-labs.cloud

Until then, the ExternalSecret will show SecretSyncedError — expected.

cluster/platform/external-dns-cloudflare/values.yaml

@@ -0,0 +1,46 @@
+# ------------------------------------------------------------------------------
+# external-dns-cloudflare — Helm Values
+# Chart: https://kubernetes-sigs.github.io/external-dns
+#
+# Provider: Cloudflare
+# Zone: mk-labs.cloud (public)
+#
+# This is a second ExternalDNS instance running alongside the existing
+# Technitium (rfc2136) instance which handles local.mk-labs.cloud.
+# ------------------------------------------------------------------------------
+
+provider:
+  name: cloudflare
+
+env:
+  - name: CF_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: cloudflare-api-token
+        key: cloudflare_api_token
+
+# Only manage records in the public zone
+domainFilters:
+  - mk-labs.cloud
+
+# Sources: ingress and services
+sources:
+  - ingress
+  - service
+
+# Annotation to opt resources into public DNS management.
+# Use: external-dns.alpha.kubernetes.io/hostname: myservice.mk-labs.cloud
+annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
+
+# Log level
+logLevel: info
+
+# Interval between sync runs
+interval: "1m"
+
+# Policy: sync = create AND delete records. Use upsert-only to be conservative.
+policy: sync
+
+# Registry to track which records external-dns owns
+registry: txt
+txtOwnerId: fastpass