feat(kubectl): add direct HTTPS API endpoint

[xnoto]

Summary

• publish api.makeitwork.cloud as an HTTPS Cloudflare Tunnel route to the Kubernetes API Service
• keep the Access-gated k3s.makeitwork.cloud TCP route as a migration fallback
• switch the canonical kubeconfig and operator documentation to direct Dex OIDC access

Security

• Kubernetes Dex OIDC and RBAC remain the API authentication boundary
• public client TLS terminates at Cloudflare
• origin traffic remains encrypted, but uses noTlsVerify: true until the Kubernetes service CA is mounted through ClusterTunnel.originCaPool

Validation

• pre-commit run --all-files
• kustomize build workloads/kubectl-tunnel
• secret scan and git diff --check

Rollout

Merge after the paired tfroot-cloudflare PR creates the api.makeitwork.cloud CNAME. Validate discovery, watches, logs, exec, copy, and port-forward before retiring the TCP fallback.