platform: add external-dns-cloudflare for public mk-labs.cloud zone

Deploy a second ExternalDNS instance targeting Cloudflare to manage
public DNS records in the mk-labs.cloud zone. The existing Technitium
(rfc2136) instance handling local.mk-labs.cloud is unchanged.

Components:
- application.yaml: ArgoCD Application, wave 6, namespace external-dns-cloudflare
- values.yaml: Cloudflare provider, domainFilters: mk-labs.cloud, txtOwnerId: fastpass
- externalsecret.yaml: ExternalSecret pulling CF_API_TOKEN from 1Password

PREREQUISITE (manual): Ryan must create the following in 1Password before
the ExternalSecret will sync:
  Item name:  cloudflare-external-dns
  Field name: api-token
  Value:      Cloudflare API token with DNS Edit on mk-labs.cloud

Until then, the ExternalSecret will show SecretSyncedError — expected.

cluster/platform/external-dns-cloudflare/application.yaml

@@ -0,0 +1,42 @@
+# ------------------------------------------------------------------------------
+# Platform: external-dns-cloudflare
+# Wave 6 — same wave as existing external-dns (Technitium)
+# Multi-source: Helm chart from upstream + ExternalSecret from repo
+#
+# PREREQUISITE: 1Password item "cloudflare-external-dns" with field "api-token"
+# must exist before the ExternalSecret can sync and ExternalDNS can start.
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-dns-cloudflare
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "6"
+spec:
+  project: default
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://kubernetes-sigs.github.io/external-dns
+      chart: external-dns
+      targetRevision: 1.15.1
+      helm:
+        valueFiles:
+          - $values/cluster/platform/external-dns-cloudflare/values.yaml
+    # Source 2: Repo — values ref + ExternalSecret manifest
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/external-dns-cloudflare
+      ref: values
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-dns-cloudflare
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/external-dns-cloudflare/externalsecret.yaml

@@ -0,0 +1,32 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Cloudflare API Token
+# Pulled from 1Password, materialized in the external-dns-cloudflare namespace.
+#
+# PREREQUISITE: Ryan must create the following 1Password item before ArgoCD
+# can sync this secret successfully:
+#   - Item name:  cloudflare-external-dns
+#   - Field name: api-token
+#   - Value:      A Cloudflare API token scoped to DNS Edit on mk-labs.cloud
+#
+# Until that item exists, the ExternalSecret will report SecretSyncedError —
+# this is expected and acceptable. The ExternalDNS pod will fail to start
+# until the secret is available.
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: external-dns-cloudflare
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: cloudflare-api-token
+    creationPolicy: Owner
+  data:
+    - secretKey: cloudflare_api_token
+      remoteRef:
+        key: cloudflare-external-dns   # 1Password item name
+        property: api-token            # 1Password field name

cluster/platform/external-dns-cloudflare/values.yaml

@@ -0,0 +1,46 @@
+# ------------------------------------------------------------------------------
+# external-dns-cloudflare — Helm Values
+# Chart: https://kubernetes-sigs.github.io/external-dns
+#
+# Provider: Cloudflare
+# Zone: mk-labs.cloud (public)
+#
+# This is a second ExternalDNS instance running alongside the existing
+# Technitium (rfc2136) instance which handles local.mk-labs.cloud.
+# ------------------------------------------------------------------------------
+
+provider:
+  name: cloudflare
+
+env:
+  - name: CF_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: cloudflare-api-token
+        key: cloudflare_api_token
+
+# Only manage records in the public zone
+domainFilters:
+  - mk-labs.cloud
+
+# Sources: ingress and services
+sources:
+  - ingress
+  - service
+
+# Annotation to opt resources into public DNS management.
+# Use: external-dns.alpha.kubernetes.io/hostname: myservice.mk-labs.cloud
+annotationFilter: "external-dns.alpha.kubernetes.io/hostname"
+
+# Log level
+logLevel: info
+
+# Interval between sync runs
+interval: "1m"
+
+# Policy: sync = create AND delete records. Use upsert-only to be conservative.
+policy: sync
+
+# Registry to track which records external-dns owns
+registry: txt
+txtOwnerId: fastpass