Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/cloudflared/secret.example.yaml

@@ -0,0 +1,23 @@
+# Template. Copy to secret.yaml, fill in the real token, and apply.
+# secret.yaml is gitignored — same convention as ../../platform/cert-manager, ../../apps/netbox
+# and ../../apps/smtp-relay.
+#
+# The token IS the tunnel credential: it embeds the account tag, tunnel ID and
+# tunnel secret, so anything holding it can serve traffic for the tunnel. It is
+# also all cloudflared needs — the ingress rules come from the Cloudflare API,
+# managed by ./terraform.
+#
+# Where to get it:
+#   Cloudflare dashboard -> Zero Trust -> Networks -> Tunnels -> <tunnel> ->
+#   Configure -> the `cloudflared service install <TOKEN>` command contains it.
+# Rotating it there requires re-applying this Secret and restarting the
+# Deployment; the tunnel UUID does not change.
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflared-tunnel
+  namespace: cloudflared
+type: Opaque
+stringData:
+  token: REPLACE_WITH_CLOUDFLARE_TUNNEL_TOKEN