Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

platform/cert-manager/secret.example.yaml

@@ -0,0 +1,20 @@
+# Template for cert-manager/secret.yaml (gitignored). Copy, fill in, apply.
+#
+# Same token as cloudflared/terraform/terraform.tfvars — extract it with:
+#   sed -nE 's/^[[:space:]]*cloudflare_api_token[[:space:]]*=[[:space:]]*"([^"]*)".*/\1/p' \
+#     cloudflared/terraform/terraform.tfvars
+# (a naive `cut -d= -f2` also swallows the trailing comment on that line)
+#
+# Must live in the cert-manager namespace: a ClusterIssuer resolves solver Secret
+# refs in the namespace where cert-manager runs, not where the Certificate is.
+#
+# ⚠ This token also carries Account·Cloudflare Tunnel:Edit. Replacing it with one
+# scoped to Zone·DNS:Edit on ddupan.top would shrink the blast radius to DNS.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+type: Opaque
+stringData:
+  api-token: "REPLACE_WITH_CLOUDFLARE_API_TOKEN"